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DATED: March 28; 1994 
SEARCH NUMBER: 94-7-3069 ; | | k^ 


Dear Client: | 

THIS COMPANY certifies that it has condücted a search of the 
records in the office of the Town. Clerk of the. County of ‹ 
‘FAIRFIELD, CONNECTICUT , for Last owner(s), Open Mortgages, 
Judgments, Federal Tax Liens, Lis Pendens, Mechanic ‘Liens’ and 
Warrants against the subject: premises set forth ‘below. 


SUBJECT PREMISES:. 1241 East: Main. Street, Stamford, Connecticut 
` mr 
Тһе following returns were found of the record: 


E 


DEED: (Quit-Cilaim) , 


New England. Mutual Life Dated 4-5-90 
Insurance Company | 
Recorded 4-6-90. 
-то- | 
Book 3556 Page 263 
Titan Sports, Inc. е . | 
(Last Deed of Record) °  Qonn.T.T. Paid $75,500.00 


City T.T. Paid $8,305.00 


(Continued), 


MORTGAGE: (A) 
Titan Sports, Inc. 
-TO- 


‘Union Trust Company 


Amount $8,500,000.00 
Dated 11-29-90 


Recorded 11-29-90 


` Book 3638 Page 342 


Note:- As to this Mortgage there js a Modification Agreement 
Recorded. 9-28-93 in Book 4113 Page 65. (See Сору” оғ 


First. page Enclosed) 


MORTGAGE: (B) à 
Titan Sports, Inc. 
.=T0- 


Union Trust Company 


Amount $5 „000,000. 00 
Dated 10-7-91 


Recorded 10-7-91 


Book 3750 Page 133 


Note: As to this. Mortgage there is а Modification. Agreement 
Recorded. 9-28-93 in Book 4113 Page-.69. (see Copy of 


First page Enclosed) | 


ха 


Nuus, * уж 
MORTGAGE: (С) 
° Titan Sports; Inc. 


-TO- 


- 


‘Union Trust Company 


UCC-1: (Seé Copy Enclosed). 
Recorded in Book 413 Page 87 
Debtor: Titan Sports, Inc. 


Secured Party: Union Trust Company 


(Continued). 


Amount %2,250;000.00 
Dated. 9-28-93 
Recorded 9-28-93. 


Book 4113 Page 73 


MECHANIC'S LIEN: 


Recorded 5-29-91 in Book 3695 Page 183 


Post Road Iron Works, Inc. я 


-VS- 2 
Titan Sports A/K/A Titan Sports, Inc. ` ` ` š b6 
and РІС 


Specialty Management Company 


NOTE: 


.NOTE: 


NOTE: 


Unrecorded lease between Cove View Tower Associates Limited 


Partnership, Landlord, and CLU, Ténant, 
dated November 14, 1981, “whic Lease, as amended; ‘was assigned 


to Titan Sports, Inc., by New England ‘Mutual Life Insurance 


Company, ав successor to Cove Tower Associates Limited 
Partnership. 


Unrecorded Lease between Cove View Tower Associates. Limited 
Partnership, "Landlord, and Homestaff ‘Health Care Services, 
Inc., Tenant, dated August 15, 1988, which lease was assigned 
to Titan Sports, Inc.; by' New England: Mutual Life Insurance 


Company, as successor to Cove View Tower Associates Limited. 
Partnership. 


Taxés on the List of 10-1-92 have been pata in full in the 
Amount of $296, 779.65 


Taxes on the List of 10- 1-93: Due and payable 7-1-94. апа 
1-1-95. 


(Continued) 
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No other returns were found of the record from 4-6-90 to date. 


Said subject premises are also known and designated on the 


CITY OF STAMFORD, FAIRFIELD County Tax Map as: 


— P 


Мар. No. : 221 Block: 138 Lot: A 


This Company's maximum liability hereunder is limited to the 


total fee paid for this search. No liability is assumed for items 


not indexed or misindexed. Thi& report-is based upon information 
supplied by the applicant as to the location and identification of 
the premises, and no liability is assumed for any discrepancies 
resulting therefrom. This report is offered for information: only 
and does not. represent either a commitment to insure Title or an 
opinion as to the marketability of Title to the subject premises. 


SEARCH DATE: 3-21-94 


JADE DATA RESEARCH, INC. 
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% 3 5” 2; ji | : 
3 z ы! Ге * 
RS ДЕ: va. 3556 »a203 Block (33 
b Ж; 
P ARD. QUIT-CLAIM DEED ' 4574 
m" БИ "S 
$ Ej 
b TH E KNOY ALL PERSONS BY THESE PRESENTS THAT 
E 9 + В 
| у E т š Ж НЕМ ENGLAND KUTUAL LIFE INSURANCE COMPANY,. а Massachusetts corporation %- 
z Yu У “lL with а placa of business at 501 Boylston Street, Boston, КА 02117 (the ye 
5 EU os *Releasor"), for Ono Dollar and other considoration racaived to its full 2.0 
EN satisfaction of TITAN SPORTS, INC., a Delaware corporation with a place of су 
UE mes business at 1055 Sumer Street, Stamford, CT 06905 (the *Reloasco") has as 
" 22 ° renised, released, and forever quitclained, and does by these presents, for 
E u itself and its successors, justly and absolutely remise, release, and PR d 
{- EO! QUIT-CLAIH unto tho Releasse, its successors and assigns forever, all such wm 
р БЕ right end title аз the Releasor has or ought to have in or to that certain 9 
j AD piece or parcel of land, with the improvements thereon and appurtenances % 
Li thereto, known es-Ho. 1241 East Hain Street, situated in tho Town.of Stanford, ® 
E County of Fairfield, and State of Connecticut, and nore particularly bounded 
A ЖУ and described as set forth on Exhibit A attached horeto and made a part 
-". ac hereoft Р 
-” ча * , М 
| %, $e Ы TO HAVE AND TO HOLD such real property чп%ю the Releases and its 
MP E ; successors and assigns to the only use and behoof'of the Releases, its 
Қ i E 2% succassors and assigns forever, so that neither the Releasor nor any other 
Ж ҰЯ a person or persons in its name and behalf or claiming under 1t will hereafter: 
= % D claia or demand any right or title to such real property or any part thereof,. 
" 35 ,, but they and each of them shall by these presents be excluded and forever 
E EN barred, 
Lo 5254 j : 
5 EG IH WITNESS WHEREOF tha Releasor has caused this Quit-Clain Deed to be 
er. ң executed as of this SÑ day of April, 1590, š 
US 
ر‎ 
pon . 
5 P Witnessed by: |, i ; 
3 4 Š ы NEW ENGLAND MUTUAL LIFE 
INSURANCE COMPANY + 
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"By: COPLEY REAL ESTATE ADVISORS, INC. 
a Hassachusetts corporation, 
its assot manager and advisor 
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EXHIBIT А . 41 


ALL that certain piece, parcel or trict of land, together 
: with the buildings and improvements located 'thereon, situated 
T in the City of Stamford, County of Fairfield and State of 
Mhe Connecticut, shown on a certain map entitled, "Hap Showing 
о Property Surveyed For Stephen Gulick, Jr. & Richard А. Engelke 
= Stamford, СЕ." dated 27 Nov. 1979: by Raymond L. Redniss #10046, 
` „which пар is on file іп the office of the Town Clerk of 
Stamford аз Мар No. 10447. In accordance with said map, the 
premises are bounded as follows: 


ғ BEGINNING at а point marking the Northwesterly corner of 
the premises herein described, which point marks the inter- 
section of the Easterly boundary of Home Court with the 
Southerly boundary of. Main Street and proceeding thence along 
the following courses and distances: North 40° 38! 10" East 
61.04 feet and North 52' 54! East 218.05 feet along the 
Southerly boundary of Main Street (U.S. Route 1); thence in a 
Southerly direction South 37% 06! East 5.00 feet and in an 
Easterly direction North 52° 54" East 10.00 feet, both along 
land of Stephen Gulick, Jr. and Richard A. Engelke or the State 
of Connecticut, to the Westerly boundary of Houston Terrace; 
thence in a Southerly direction South 25° 35' 30" East 235.66 
feet along the Westerly boundary of Houston Terrace, thence in 
a Westerly direction South 66° 12' West 184.72 feet along land 
now or formerly of Dario Garcia; thence North 24° 08% 50" West 
63.48 feet and South 65° 55' 10" West 100.00 feet both along 
land now or formerly of Anthony Palermo et al to the Easterly 
boundary of Home Court; thence North 24% 04! 50" West 98.61 
feet along the Easterly boundary of Home Court to the point or 
place of beginning. 


Said premises are the same as shown on a-map bearing the 
title "Мар Showing Property Surveyed for Cove View Tower 
Associates Limited Partnership, Stamford, Ct.", which map is 
dated April 10, 1981 and revised. February 24, 1983 and 

e certified February 25, 1983 by Raymond L. Redniss #10046, 
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ATTEST: LOIS POWTSRIANT, ТОМИ AND CITY CLERK 
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138 қ. COMMERCIAL MORTGAGE DEED 19998 
TO ALL PEOPLE TO WHOM THESE PRESENTS SHALL СОМЕ, GREETINGS: KNOW YE, that TITAN SPORTS, INC; - 


fe 
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HUNDRED: THOUSAND and 00/100 
(hereinafter referred to as the “Mortgagor’"), for the consideration of „EIG Dollars ($_ 9» 2U9, U0 .00 у 
received to its full satisfaction of UNION TRUST COMPANY, a corporation organized and existing under the laws of the State of Соп. 
nectkut, and having its principal office in the City of Stamford, Connecticut (hereinafter referred to as the **Mortgagec!'), DOES GIVE, 
GRANT, BARGAIN, SELL AND CONFIRM unto the Morigagee, its successors and assigns, forever, the premises described En Schedule 
A attached hereto and made a рап hercof, hereinafter referred to as the "Premises; б ar 


PET 
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TOGETHER with the following property tights: (i) all right, title and Interest of the Mortgagor in and to all of the tenements, hered- 
laments, privileges, easements, franchises, rights, appendages and appurtenances thereunto belonging or in any wise appertaining and the 
reversion or reversions, remainder and remainders, rents, Issues and profits thercof; and all the estate, right, title, interest, property, claim 
and demand whatsoever of the Mortgagor of, in and to the same and of, іп and to every part and parcel thereof; (ii) all interests of the 
Mortgagor in and to any streets, ways, alleys and strips of land adjoining said Premises of any part thereof; (iii) any and aW buildings and 
other improvements now or at any time hereafter constructed, erected, installed or placed in or upon the Premises and all the income, 
rents, issue and profits arising therefrom and for use thereof: (iv) any and all materials, fixtures, equipment, or other property now or at 
any time hereafter affixed or attached to or placed upon or used in any way in connection with the buildings and other improvements now 
erected or hereafter to be erected on said Premises, including, but not limited to, furnaces, boilers, oil burners, radiators and piping, 
plumbing and bathroom fixtures, refrigeration, air conditioning and sprinkler systems, wash-lubs, sinks, gas and electric fixtures, stoves, 
tango, awnings, screens, window shades, clevators, motors, dynamos, refrigerator, kitchen cabinets and incinerators, all of which prop- 
erty and things are hereby declared to be permanent fixtures and accessories, and part of the realty conveyed herein as security for the 
indebtedness secured hereby; (v) all monetary deposits to any utility company furnishing services to the Premises and all permits and 
licenses obtained ín connection with the Premises; and (vi) all awards, including interest thereon, with respect to the Preimives asa 1суШ of 
the exercise of the right of eminent domain, including any awards for changes of grade of streets affecting the Premises and for any other 

-injury to or decrease in the value of the Premises, which awards are hereby assigned to the Мопуарес. 
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TO HAVE AND TO HOLD the foregoing property (the Premises together with such property and rights hereinafter collectively 
called the “Mortgaged Property’), with all the privileges and appurtenances thereunto belonging, unto the Morigagce, its successors and 
assigns forever, to its and'their own proper use and behoof, ` E 
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AND, ALSO, it, the Mortgagor, does for itself and its successors and assigns, covenant with the Mortgagee, its successors and 
assigns, that at and until the enscalíng of these presents, it is well seized of the Premises as a good indefeasible estate in FEE SIMPLE sub. 
ject only to the matters set forth in Schedule B attached hereto and hereby made асрап hereof, and has good right to bargain, sell and соп. 
vey the same in the manner and form as above written, and that the same are {ree [rom all encumbrances whatsoever, except as aforesaid, 


9 
LS 
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I An 4 MOMS ^ ee 
5 AND FURTHERMORE, the Mortgagor docs by these presents bind itself and its successors and assigns forever tO WARRANT AND Fuge 
ae DEFEND the above granted and bargained Premises to the Morigagee, its successors and assigns, against all claims and demands whatso- Е: i А 


ever, subject only as aforesaid. 
‚ * ` 
THE CONDITION OF THIS DEED IS SUCH THAT WHEREAS the Mortgagor is justly indebted to the Mortgagec in the sum of 
EIGHT MILLION FIVE HUNDRED THOUSAND Dollars (5 .8,500,000.00 ) as evidenced by its promissory note of even date 
TEE А herewith for said sum, payable to Mortgagee (a copy of which note, differing only from such promissory note in that the rate of interest 
иш we С has been omitted, is апасһей hereto and made a part hereof as Schedule C) together with all other notes given In substitution therefor or in 
j modification, renewal or extension thereof, in whole or in part, such promissory note and all other notes given [n substitution, modifica- 
tion, tencwal or extension thereof, in whole or in part, together with any modifications or amendments which may be entered into from 
. time to time, herein referred to as the “Мой”, and with interest thereon, and with prepayment terms and other costs and expenses payable 
газ set forth therein (the Indebtedness"): and ` " ` 
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WHEREAS, the Mortgagor, in consideration of the foregoing matters, has executed and delivered to the Mortgagce the Note; and 
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WHEREAS, the Mortgagor covenants with and represents and warrants to the Mortgagee as follows: 


а» ow 


„= 1. Payments, Mortgagor will promptly pay when due the Indebtedness, including principal with interest thereon, and all other sums 
required to be paid by Mortgagor under the Note and pursuant to the provisions of this Mortgage and every other instrument securing the 
Note, > 


2. Taxes and Assessments, The Mortgagor shall рау ай taxes, assessments, and water rates, sewer rents, special assessments, and 
. Other charges (hereinafter collectively referred to as **taxes') now or hereafter levied against the Premises. 
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i 3. Insurance, Mongagor will provide, maintain, and deliver to the Mortgagee policies of fire, flood, liability, and extended coverage 
| insurance and policies of cach other insurance as the Mortgagec may from time to time require, in amounts and in companies and form 
l 
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satisfactory to the Mortgagee, with loss payable to the Mortgagce under a standard Connecticut non-contributing mortgagee clause, and 
„ shall assign and deliver to the Mortgagee all insurance policies of any kind or in any amount now or hereafter issucd upon the Premises. 10 
` the event of loss under any policy of insurance herein referred to, the proceeds of such policy shall be paid by the insurer to the Mortgagee, 
and the Mortgagee, in its sole discretion, shall apply such proceeds (i) first to the payment of all principal and interest then due onthe Note 
and then to the prepayment of the principal of the Note, such prepayments to be made in the inverse order of maturity, of (И) toward the 
reconstruction, repair or restoration of the Premises. Not less than 15 days prior to the expiration dates of each policy furnished pursuant 


cy or policies marked “premium paid" or accompanied by other evi- 
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to this paragraph, Mortgagor will deliver to Morigagec а renewal poti 
dence of payment satisfactory to Mortgagec. 
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4. Tax and Insursace Escrow, The Morigagee may at its option, upon written notice to the Mortgagor, require the Mortgagor to 
deposit in escrow with the Mortgagec, together with ard іп addition to the monthly payments of principal and interest payable under the 
terms of the Note, a sum equal to one-twelfth of the annual taxes or of annual premiums for insurance policies covering the Premises, or 
` À + ° both. The escrow funds shall not bear interest and may be commingled with other funds of the Мопфакес. Although the Mortgagec 
intends to use its best efforts to make such payments in a timely fashion, the arrangements provided for in this paragraph are solely for the 


` 
NE 
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7 
5, 


| added protection of the Mortgagee and entails no responsibility on the Mortgagec's part beyond the allowing of due credit. without intere d ve 

" | est, for sums actually received by it, If the whole of said principal sum and interest shall be declared duc and payable by the Mortgagee Tes 
. pursuant to paragraph 18 hereof, all such deposits may, at the option of the Mortgages, be applied in teduction of said principal sum or Б p 

l interest. Upon full payment and satisfaction of this Mortgage or at any prior time, at the election of the Mortgagee, the balance of the E 

» deposits in its possession shall be paid over to the record owner of the Premises, and no other party shall have any right or claim thereto in 4 br 
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MORTGAGE MODIPICATION AGREEMENT 


MORTGAGE MODIFICATION AGREEMENT, made as of September 28,. 


1993, by and between TITAN SPORTS, INC., .a Delaware corporation 
having an ‘office at 1241 East Main Street, Stamford, Connecticut 
(the *Mortgagor"), and UNION TRUST COMPANY, having an office.at 
300 Main Street, Stamford, Connecticut (the "Mortgagee"). 


RECITALS 


The Mortgagee made an $8,500,000 loan (the "Loan*) to the 
1990, evidenced by a Term/Tine 
Promissory Note and Security Agreement (the '"Original Note") 
dated that date. The Loan is secured by a Commercial Mortgage 
Deed dated November 29, 1990 (the *Mortgage*), which was recorded 
ЕНЕР е in Volume 3638 at Page 342 of the Stamford Land 
ecords. 


The Hortgagor and the Mortgagee desire (i) to alter the 
periodic payments on the Loan, (11) to extend its maturity date 
and (iii) to modify the interest rate applicable to the Loan. 'In 
furtherance thereof, said parties have executed a Loan 
Modification Agreement of even date herewith (the "Loan 
Modification Agreement"). 0 


The Mortgagor and the Mortgagee wish to modify the Mortgage. 


to reflect the modifications to the Loan effected by, the ‘Loan 
Modification Agreement. ! 


In consideration of the Recitals, which are incorporated by "Ñ 


reference, and other good and valuable. consideration, the receipt 

and sufficiency of which is hereby: acknowledged,. the, Mortgagor 

and the Mortgagee hereby agree that: i i ` 
"The Mortgage is amended by defining the term "Noto", as 
used therein, to specifically include (without 
limitation) the following modifications to the Original 
Hote reflected.in the Loan Modification Agreement: 


(i) The Loan shall be repaid by tho Maker in 
thirty-seven (37) consecutive monthly 
installments which shall be due and payable on 
the first day of each month, commencing 
October 1, 1993, with the last such payment 
due and payable on October 1, 1996. The 
principal amount of the Loan Outstanding on 
September 30, 1993 shall be amortized over an 
assumed seven (7) yoar tern with, monthly 
payments and at.the interest rate in effect on 
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| COMMERCIAL MORTGAGE DEE 
TO ALL PEOPLE TO WHOM THESE PRESENTS SHALL COME, GREETINGS: KNO 


(hereinafter referred to as the "Mortgagor"'), for the contideration of Five М on & 00 

received to its full satisfaction of UNION TRUST COM PANY, a corporation organized and exista 
necticut, and having its principal office in the Cit y of Stamford, Connecticut (hereinafter r 
GRANT, BARGAIN, SELL AND CONFIRM unto the Mortgage, its successors and assigns, f 
A attached hereto and made a part hercof, hereinafter referred toas the "Premises; 


vtm 


n E i 


TOGETHER with the following property rights: (i) all tight, title and interes of the Mor 
itamentt, privileges, easements, franchises, rights, appendages and appurtenances thereunto 
reversion of reversions, remainder and remainders, rents, issues and profits thercof; and alt the estate, г} 


and demand whatsoever of the Mortgagor of, in and to the same and of, in and to every part and Parcel thereof; (8) ak осто of he CSS 
Mortgagor in and to any streets, ways, alleys and strips of land adjoining said Premises or any part thereof; (i) amy and a: 3 


other improvements now of at any time hereafter constructed, erected, installed or placed in oe upon the 
rents, issue and profits arising therefrom and for use thercof: (iv) any and all materials, fixtures, equi 
any time hereafter affixed or attached to or placed upon or uscd in any way in connection wi 3 
erected or hereafter to be crected on said Premises, including, but not limited to, furnaces;.boilers, ой burners, ining... 
plumbing and bathroom fivtures, refrigeration, air conditioning and Sprinkler systems, wash M 


HOV ОГА, 


TO HAVE AND TO НОГО the foregoing Property (the Premises to 


called the “Mortgage Property’), with all the privileges and appurtenances thereunto belonging, unto theN 
assigns forever, to ns and ther own Proper use and behoof, 


+ -” 


Ps +e 


AND, ALSO, it, the Mortgagor, docs for itself and its successors and avsigns, covenant with 
assigns, that at and until the ensealing of these prevents, it í 


ject only to the matters set forth in Schedule B attached hereto and hereby made a part hereof, and has good right to bargain, sel and cone ` 
umbrances whatsoever, cxceptasaforesaidy ,, 7 


ЕЛЕСТЕТУ Ç 
Bagor docs by these presents bind itself and its successors and assigns forever to. WARRANT AND ^ 
ned Premisey to the Mortgagce, us successors and avigns, agains all claims and demands whattos. , ` 
x Y MM wiy s E 
M ее. 032... 
gagor is justly indebted to the Mortgagce in the sunyof. 
) as evidenced by ‘its Promissory note of even date x 
differing only from such promissory note in that the rate of interet 
ule C) together with all other notes given in substitution therefor of im 
such promissory note and all other notes given in subuítution, modifica- 
together with any modifications or amendments which may be entered into from 
» and with interest thereon, and with Prepayment terms and other costs and expenses payable 
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ever, wbjet only as aforesaid 7 ° 


' THE CONDITION OF THIS DEED IS SUCH THAT WHEREAS the Mort 
five Million Dollars ($ 5,000,000.00 

herewith for said «um, payable to Mortgages (а copy of which note, 
has been omitted, is attached hereto and made a part hercof as Sched 
modification, renewal or extension thereof, in whole or ín part, 
tion, renewal or extension thereof, in whole or in part, 
time to time, herein referred to as the “Note” 
as set forth therein (the “Пмісмедпем 9; and 


к. 


= 7a э» 


WHEREAS, the Mortgagor, in consideration of thc foregoing matters, has executed and dclivered tothe Mortgagee the Notes and 


WHEREAS, the Mortgagor covenants with and represents and warrants to the Morigagceas follows; 


1. Payments, Mortgagor will promptly pay when due the Indebtedness. including principal with interest thercon, and all other sams 


required to be paid by Mortgagor under the Note and pursuant to the provisions of this Mortgage and every other instrument securing the 
Note. Ў 


“ > 

T А 
assessments, and water rates, sewer tents, special assessments, and 
tarev”) now or hereafter levied against the Premises, 


2. Taxes and Assessments, The Mortgagor shall pay all taxes, 
other charges (hereinafter Collectively tcferred toa °" 


ere 


3. lasurance, Mortyayor will Provide, maintain, and deliver to the Mortgagee policies of fire, flood, liability, and extended coverage 
insurance and policies of each other insurance as the Mortgagee may from time to time requite, in amounts and in companies and form 
Satisfactory to the Mortgagee, with low payable to the Mortgages under а standard Connecticut non-contributing mortgagee clause, and 
shall avign and deliver to the Mottgagce all insurance Policies of any kind or in any amount now or hercafter issued upon the Premnes. In “ 
the event of low under any policy of insurance herein referred to, the proceeds of such policy shall be Paid by the insurer to the Mortgagce, 
and the Mortgages. in its sole discretion, shall apply such proceeds (i) first to the payment of all Principal and interest then duc on the Note ` 
and then to the prepayment of the Principal of the Note, such Prepayments to be made in the inverse order of maturity, or (ii) toward the 
teçonuruction, repair or restoration of the Premises, Not lew than 13 days prior to the expiration dates of cach policy furnished pursuant 


to this Paragraph, Mortgagor will deliver to Mortgagee a renewal policy or policies marked “premium ракі" or accompanied by other evi- 
dence of pay ment satisfactory to Mortgagee. 07 


x 
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| 
i 
1 
4 
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3. Tax sad Insurance Escrow, The Mortgagee may at its option, upon written notice to the Mortgagor, require the Mortgagor to- 
deposit in escrow with the Mortgagce, together with and i iti 


terms of the Note, a sum equal to one-tuelfth of the ann 
both. The escrow funds shall not beat interest and may be commingled with other funds of the Mortgagee. Although the Mortgagee 
timely fashion, the arrangements provided for in this Paragraph are solely (or the 


€t, “ce sums actually received by it, If the whole of said principal sum and interest shall be declared due and payable by the Mortgage Қы 


PU. int to paragraph 18 hereof, all such deposits may, at the option of the Mortgagce, be applied in reduction of said principal sum of 
interest. Upon full payment and satisfaction of this Morteaee се at anv еды ac cha ss wx .. 
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4 MORTGAGE MODIFICATION. AGREEMENT ' ЗЕ š 
: : І ЖЫ 24% š ` : } 
2 E MORTGAGE MODIPICATION.AGREEMENT, made as of Soptember 28, EE 2 
S con 1993, by and between TITAN SPORTS,.INC.,.à Delaware corporation i Т i : 
2 p ‘having an office at 1241 East Main Street, Stamford, Connecticut ` 7 ° HEE 
ДЕС (the "Mortgagor"), and. UNION TRUST COMPANY, having an office ас ЙІН 
š = 300 Main Street, “Stamford, Connecticut (the "Mortgagee"). ; “Eh i 
^B Я n Я I -- I ШИНЫ 
3 RECITALS $ ! б 3 ЛЕР! 
TG pv . The Mortgagee made an $5,000,000 loan (the *Loan*) to the > | ЭШ. 2 re 
+, AUT .Mortgagor on October 7, 1991, evidenced by а Term/Time Promissory г» „Ер 
сазды .Note and: Security Agreement (the “Original Note") dated that : К ie 
Yn SN date. The Loan is secured.by a Commercial Mortgage Deed dated ; Ғ ji 
\ КОЙ October 7, 1991 (the "Mortgage"), which ‘was recorded that дасе іп ; HB 
е ee Volume 3750 at ‘Page 133 of the Stamford Land Records. кееш. i | 
езе | | | ! _ wigs ӘНЕ 
T3 The Mortgagor and the Mortgagee desire to alter the periodic ` TES 
Алан payments on the Loan and to modify the interest rate applicable ` { HIE 
esp ‘to the Loan. Іп furtherance ‘thereof, said parties have -executed. . ЕЕЛ Ге; 
EIS .à Loan Modification Agreement of even date herewith (the "Loan mii 
Modification Agreement"). ; Н i B 
š š 1 Ed 
4 е d E D "Ur = sz. a=: м ve af 
The'Mortgagor and the Mortgagee wish to modify the Mortgage «БІНЕ 
to reflect the modifications to the Loan effected by the Loan ір i 3 
Modification Agreement. s: 8812 
In consideration of the Recitals, which are incorporated by rh Ы š 
reference, and other good:and valuable consideration, the receipt. 5 5 
and sufficiency of which is hereby acknowledged, the Mortgagor E 
and the Mortgagee hereby agree that: | у FEH 
ip "The Mortgage is amended by defining the term "Note", as p 3 
; used therein, to specifically include (without : 
LES Jimitation) the following modifications to the Original “ЕН 
XE Woto.reflected in the Loan Modification Agreement: 2 1 
pin (i) The Loan shall be repaid by the Maker іп . шағ 
TM Ë thirty-seven (37) consecutive monthly И , $ 
y i 
I N 
l it 


HET the first day of each month, commencing - p 
Же October 1, 1993, with the last such payment š 
E due and payable on October 1, 1996. The 
е НА : Principal amount of the Loan outstanding on 
Tess ‘September 30, 1993 shall be amortized over an 
Yi By. assumed. seven (7) year term with monthly 
Бохара payments and ас the interest rate in effect on 


October 1, 1993 determined as herein set 
1 uL 
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COMMERCIAL “MORTGAGE DEED 
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by 
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e mation 


TO ALL PEOPLE TO WHOM THESE PRESENTS SHALL COME, GREETINGS: 
KNOW ‘YE, that TITAN SPORTS, .INC., a Delaware corporation having 
an office at 1241 East Main Street, Stamford, Connecticut 


oy өбө. o pu Pen No Saa pt 


et tm 


tenoments, ‘hereditaments, privileges, easomonts, franchises, 
rights, appondages and appurtonancos therounto bolonging or in 
any wise apportaining and ‘the reversion or rovorsions, romaindor. 
"and romaindors, .ronts, issuos and profits thoraof; and all ‘tho: 
estato, right, title, interost, proporty, claim and domand 
whatsoovor of tho Mortgagor of, in and to tho samo and of, in.and 
to overy part and parcol thoroof; (11) ‘all intorosts of tho 
Mortgagor іл and to any stroots, ways, alloys and strips of land 
adjoining said Promises or any part thoroofj (i11) any and all 
buildings and othor improvomonts now or at any time horoafter 
constructed, erocted, installed or placed in or upon the Promises 
and all the income, rents, issue and profits arising therefrom 
.and for the use thereof; (iv) any and all materials, fixtures, 
equipment, or other property now or.at any time hereafter affixed: 
or attached to or placed upon or used in any way in connection 
with the buildings: and other improvements “now erected or. 
hereafter to be erected on said Premises, including, but not 
limited to, furnaces, boilers, oil burners, radiators and piping,. 
plumbing .and bathroom fixtures, refrigeration, air conditioning 
and sprinkler systems, wash-tubs, sinks, gas and -electric 
fixtures, stoves, ranges, awnings, “screens, window ‘shades, 
‘elevators, motors, .dynamos, refrigerators, kitchen cabinets and 
incinerators, all of which property and things .are hereby 
‘declared to bo permanent fixtures and accessories, and part of 
‘the realty conveyed herein ав security for the indebtedness 
secured hereby; (У) all monetary deposits ‘to. any utility company 
furnishing services to the Premises and all permits and licenses 
obtained in connection with the Premises) and (vi) all awards, 
including interest thereon, with respect to the Premises as a 


1 


ЖҮ 
4% 


А г. (hereinafter referred ‘to as,-the '"Mortgagor*), for the i E, 
ETT . consideration of Two Million Two: Hundred Fifty Thousand Dollars . š. g 
ЖАС ($2,250,000.00) received to its full satisfaction of UNION TRUST rE 
К: БАД 2 COMPANY, a corporation organized-and existing under the laws of ES { 
3rd the State of Connecticut, and having. its principal office in the EE H 
B ECC City of Stamford, Connecticut (hereinafter referred to as the au 
FSE "Mortgagee"), DOES GIVE, GRANT, BARGAIN, SELL AND CONFIRM unto š % 
ERS the Mortgagee, its successors and, assigns, forever, tthe premises ` 
Ys. described in Schedule A attached hereto and made.a part hereof, " . 

53 hereinafter referred to as the "Premises"; ^ 
[6b s. | 

о ЧЫ ` TOGETHER with the following property rights: (1) all right, 

x d title and intorest of the Mortgagor in and to all of the 
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FD-302 (Rev. 3-10-82) ғ 


E 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 4/ 7/94 


On March 30, 1994, Special Agen bó ' 
telephonically contacted cellular car b7C 
telephone, telephone number The purpose of this 
call was to determine the f i ving and 
taking of steroids whi i the World 
Wrestling Federation 


[  lexplainea that [knew that 
[was taking steroids during this ti had a 
conversation prior to ]problem 


stated that when he left the needles in the 
hotel room and they were found,[ ^  ]was said it was 
not a big deal and that he would handle eee iene on to 
explain that[ had an attorney in Washington, D.C., and 
that attorney would be getting in contact with him. Several days 


p explained that he received a t 1 from 
who identified himself as working fo 
explained to that he had taken a shot of steroids 


just prior to leaving е hotel room, and explained that it was 
his normal custom to take a couple of bottles of steroids and 
syri e road with him to take a shot prior to working 
б ананга explained that about three іо four weeks 
called him and said that the investigation was 
stated that he hired his own attorney, pE 
(Phonetic), and eventually the matter went away. 


the steroids i stion left in the room were b7C 
is steroids апа vhether| jnew he was taking them. 
ороп е to estions by stating, "Yes. They were 
is steroids and ee I was taking them for some 
time." 


(telephonically) 
Investigationon _ 3/30/94 at New York, New York File # 196B-NY-234993 


| by Date dictated 3/30/94 
| 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


4/7/94 


Date of transcription 


b6 


On April 1, 1994, Special Agent (SA b7C 
traveled to the Administrative Offices of 
L— аза ы York, апа пек with 
Тһе purpose of i i j j 
the authors of three letters лр ee м 
[ | ana and the circumstances surrounding 
those three letters. 


Following prelimi introduction by sd ]to 


a photoco of ou ا‎ 
letters to whic 


these three 


О 

t concerning the 
ad been receiving numerous 

concerning the 


It should be noted that prior to this 1 

cy that] was selling’ 7] 
knew this because of direct communication 
around that time, either via the telephone or a 
e hallway at the World Wrestling Federation. 


explained at that meeting that 


[ | ехр1аіпеа ious road agents would come 
through and complain d about the actions 
of while at events, stating that | | 


knew as dispensin ilis to the various talent at e 
Worl restling Federation. explained that because the 


Pennsylvania law had chan elt that j erfect time 
problem. hen went on 


to do something about th 
° 

were upset that this might destroy the 
World Wrestling Federation if it continued. In late October or 
early November of 1989,| ^ had numerous heated conversations 


letters." 
letter, Ù] and 
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witd la 


апа 
that to speak 
an about the problem. After sometime, 


returned and said to 
They want him an 


h this 


hen pointed out to SAL | 


һә руф ich И O 
OOOO | The reason| [pointed this out to 


SAL [was[ [continued attempt to ossibly cut oul 
e very nex 
шая assigned to t Q which was to 


tated that between the[ C Cd letter 
and the let exact date could not be 
pinpointed. Bot andl Jwere told by th 
i iti icuxes would be attending eel o] 
— NN Pennsylvania. In addition to 
attending the match, these political figures, would be 


ied by their children and requested to go back stage. 
interjected С 


take place on | | | | 


wan 


Ww 
| | jana then] ][letter. 
| [explained tq 
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Wrestling Promoter F ights Steroid Charges 


When a professiogal wrestler 
thinks he's gotten a Bum deal, he 
snarls into the nearest camera and 


eral judge in Uniondale, 
doubtless be more soft- 
every bit as determined. 

Mr. McMahon reinvent 
Wing In the mild-1980's, sting it 
across cable channels, andidrowning 
the incredulous reactions pf media 
pundits with the ovations Of sellout 
crowds at Madison Square Garden, 
the Nassau Coliseum and other ven- 
ues, 

Now, with the wrestling business in 
decline, the 48-year-old promoter and 
his Stamford, Conn-based Titan 
Sports Corporation аге facing 
charges of illegally distributing body- 
building steroids to wrestlers. If con- 
victed, Mr, McMahon faces an eight- 
year prison term and a $500,000 fine, 

Defense lawyers will present argu- 
ments Friday in a final effort to get 
the charges dismissed before the trial 
in July and to avoid another public 
relations setback for the World Wres- 
tling Federation. The organization re- 
cently lost a lawsuit on video royal- 
ties filed by a former wrestler, and it 
Is being sued by another wrestler who 
was injured in the ring. B 

Outgrowth of Doctor's Trial 

The steroid case krew out of the 
1991 trial of George 
Harrisburg, Pa do 
illegally providing 
W.W.F. performers. 
was named in the McMghon 
an unindicted co-consp 


case as 


probably be called to testify. 


RECIOR 


Choosing not 

a head butt, but a 
lawyer, to battle 
back an attack. 


Why is the trial of a Connecticut 
businessman being held on Long Is- 


“land? 


The answer, Federal prosecutors 
say, is because the steroids were dis- 
tributed on Long Island. 

The indictment asserts that on sev- 
eral occasions between 1985 and Feb- 
ruary 1991, Dr. Zahorían distributed 


.sterlods to wrestlers at exhibitions 


and via express delivery shipments, 
‘and that during this Ите Titan Sports 
presented exhibitions at the Nassau 
Coliseum in Uniondale. 

“Ап object of the conspiracy,” the 
indictment says, “was unlawfully to 
provide W. W. F. wrestling perform- 
ers with steriods to enhance their size 
and musculature, and thereby to in- 
Crease the ticket sales for W, W. F. 
exhibitions and the profits to Titan 
and McMahon." 

Among the witnesses the prosecu- 
Чоп fs expected to call are the wres- 
tling superstar Hulk Hogan (real 
name, Terry Gene Bollea) and Emily 
Feinberg, Mr. McMahon's former 
secretary, 

Inquiries to Titan Sports were re- 
ferred to Mr. McMahon's lawyer, Jer- 
ty S. McDevitt of Pittsburgh, who 


tor and will ‘declined to comment. 


. 
Ñ ame 


H 
” 
*. 
“. 
f 


after pleading not guilty, Mr. МеМа-; 


„hon denied any involvement with ste- *: 
-roids after they were reclassified as ©. 


controlled substances In 1991, adding, 6 
“The World Wrestling Federation =° 
does not condone or tolerate the use = 
of steroids." N; 
What effect this has had on Mr. $ 
McMahon's considerable fortunes — « 


* estimated in the mid-1950's to be over г 


$100 million — fs unclear. P 

David Meltzer, publisher of The; 
Wrestling Observer, ап industry = ? 
newsletter based in Campbell, Calif. *; 
said, “I think it may affect the adver- КЫ 
tisers or whatever mainstream still „ 
watches И,” 


Mr. McMahon founded Titan Sports "` 


in 1982 and purchased the World; 
Wrestling Federation from his father, s 
the late Vincent McMahon Sr. The» 
younger Мг. McMahon appealed to a>; 
wider audience by emphasizing out-* 


rageous spectacle over traditional" . 


grunting ring action, 14 


Weakness In Wrestling bs ` 


Whatever the merits of the Govern-* . 
ment's steroid case, body building" 4 
has clearly been part of that specta- ° 
cle, with the W. W. F. taking pride ine, 
presenting huge, muscular perform-*; 
ers. Mr. McMahon is a dedicated am-* . 
ateur body builder himself, his expen-7 
sive suits tallored around a formida- . * 
ble physique. 

Alex Marvez, a Miami Herald 
sportswriter who writes a nationally. 
Syndicated pro wrestling column, : 
said the Federation remains active in, 
the Northeast, with about 70 shows a 


. year at local arenas like Madison 
»Square Garden, the Meadowlands 


and the Nassau Coliseum and smaller 


But in a statement last November + Venues: . 


But TV ratings and attendance at, < 
live shows have fallen in recent 
years. Adding to the effects of bad 
publicity, Mr. Marvez’sald, promot- 
ers “haven't been able to develop new 
talent that can draw at the box office, 
and pay-per-view has been oversatu- 
rated with other events." E 

Mr. McMahon is not, well, throwing 


An the towel. He is promoting W. W. F. 


tours in European and Middle East- 
em markets. And pro wrestling іп, 
America pile-drives on, battered but" 
unbeaten like one of Its own рада. 
tors. . 
“There аге hard-core fans" Mr., 
Meltzer said, “who would still cheer. 
Vince McMahon even if he went to 
jail tomorrow.” ` 


“s É 
J 
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When a professional wrestler 
thinks he’s gotten a bum deal, he 
snarls into the nearest camera and 
promises to wreak havoc on his oppo- 
nents. When Vincent MéMahon Jr., 
' owner of the World Wrestling Federa- 
| tion, appears tomorrow before a Fed- 
| eral judge in Uniondale, L.I., he will, 
doubtless be more soft-spoken but 
| every bit as determined. 

Mr. McMahon reinvented pro wres- 
| tling in the mid-1980's, blasting it 
| across cable channels, and drowning 
the incredulous reactions of media 
pundits with the ovations of sellout 
crowds: at Madison Square Garden, 
the Nassau Coliseum and other ven- 
ues. 

,, Now, with the.wrestling business in 
decline, the 48-year-old promoter and 
his Stamford, Conn.-based Titan 
Sports Corporation are facing 
charges of illegally distributing body- 
building’steroids to wrestlers. If con- 
victed, Mr. McMahon faces an eight- 
year prison term and a $500,000 fine. 
. Defense lawyers will present argu- 
ments Friday in a-final effort to get 
the charges dismissed before the trial 
in July and to avoid another public 
relations setback for the World Wres- 
tling Federation. The organization re- 
cently lost a lawsuit on video royal- 
ties filed:‘by a former wrestler, and it 
| is being sued by another wrestler who 
was injured in the ring. 


Outgrowth of Doctor’s Trial 


The steroid case grew out of. the 
1991 trial of George T. Zahorian 3d, a 
Harrisburg, Pa., doctor convicted.of 
illegally providing the drugs to 
үу, У. Е. performers. Dr. Zahorian 
was named in the McMahon case as 
| an unindicted co-conspirator and will 
| probably be called to testify. 


..” MANT 


Choosing not 
a head butt, but a 
lawyer, to battle 
back an attack. 


Why is the trial of a Connecticut 
businessman being'held on Long Is- | 
land? . 3 
The answer, Federal prosecutors 

Say, is because the steroids were dis- 
tributed on Long Island. 

The indictment asserts that on sev- 
eral occasions between 1985 and Feb- 
ruary 1991, Dr. Zahorian distributed 

-Steriods to wrestlers at exhibitions 
and via express delivery shipments, 
and that during this time Titan Sports 
presented exhibitions at the Nassau 
Coliseum in Uniondale. 

“An object of the conspiracy,” the 
indictment says, “was unlawfully to 
provide W. W. F. wrestling perform-~ 
ers with steriods to enhance their size 
and musculature, and thereby to in- 
crease the ticket sales for W. W. Е. | 
exhibitions and the profits to Titan | 
and McMahon." | 

Among the witnesses the.prosecu- | 
‘ton is expected to call are the wres- | 
tling superstar Hulk NHogan (real , 
name, Terry Gene Bolleà) and Emily | 
Femberg, Mr. McMahon's former | 
Secretary. 

Inquiries to Titan Sports were re- 
ferred to Mr. McMahon's lawyer, Jer- 
ry 5; McDevitt of Pittsburgh, who | 
declined to comment. 
But in a statement last November ! 
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‘after pleading not guilty, Mr. McMa- 
hon denied any involvement-with ste- 
‘roids. after they were reclassified as 
controlled substances in 1991, adding, 
“The World Wrestling: Federation 
does not condoné or tolerate the use 
of steroids.” 

What effect. this has.had оп: Mr. | 
esiimalpd S considerable fortunes — | 


estimated ín the mid-1980's to be оуег | ; 
$100 million — iS unclear. . 

David\Meltzer, publisher -of the’ 
Wresiliid Observer, an industry 
newsletter based in Campbell, Calif. 
;said, “I think it may affect the adver- 
' tisers or Whatever mainstream still 
watches jt." 

Mr. McMahon founded Titan Sports 
in 1982 and ригсһавей һе: World’ 
Wrestling Federation from his father, . 
the Jate ‘Vincent. McMahon 5г. The: 
younger Mr. McMahon appealed to a 
| wider audience by emphasizing: oUt: 
. rageous spectacle over traditional* 
| grunting ring action. 


Weakness in Wrestling: 


Whatever the merits of the Govern: 
ment’s,-steroid case, body. building: 
has, clearly, been, part, of. that ;Specta-: 
| cle, with the W.W: F. ‘taking’ pride in’ 
presenting huge, muscular: perform- 
' ers; Mr. McMahon is a dedicated am-. 
ateur body builder himself, ‘his expen-. 
sive suits talloréd around_a. formida-, 
ble physique. ^ 

' Alex, Marvez, а -Miami Herald: 
sportswriter who writes а nationally: 
' syndicated pro wrestling ‘column; 
| said the Federation remains active in. 
‘the Northeast, with about 70 shows a | 
‚.уеаг at ‘local “arenas like “Madison 
*Square, Garden, the ‘Meadowlands | 
sand the’ Nassau Coliseum and amplior 
«venues, 5.1: 7 Та Wr i 

But TViratings : апа attendance. at 
i live shows have fallen 'n recent 
“years. Adding to" the effects of bad 
publicity; Mr. Marçez:Said;ipromot- 
ers “haven't been able to develop new 
Î talent that ‘can draw at thé box office, . 
and pay-per-view has-been oversátus , 
rated with other events”. _ 

Mr. McMahon is not, ‘well, throwing | 
Ча the towel. He is promoting W. WEE, | 
tours, in European and -Middle;East- : 
„ern: màårkets: -And, pro: Wrestling. in | 
"America pile-drives. on, battered’ but | 
| unbeaten, likę: one of dts own: gladia- ' 

Ашы і. 

] “Theré- aire hard-core. fans” Mr. 
-Meltzer said, «упо лоша’ still. cheer 
‘Mince. McMahon even if:he, Went to 


jail tomorrow; m 
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Date of transcription 


| On April 13, s telephonically b6 
contacted by Special Agent at his place of 
enploment | 
[ ^ . laàvised that he was or внеле) 
TLING FEDERATION (WWF) and, in fact 
[eec Special Agen stated that the purpose of this 
call was to determine i was requested to purchase some 
cocaine 


The following is:a summarization of a rather lengthy 
April 13, 1994, which encompasses the following 


conversati 
dvised that he was employed at the WWF from 


events. 


[statea that, in fact, he had tried cocaine prior 
to his employment with the WORLD WRESTLING FEDERATION, and stated 
that it wasn’t his thing, and he didn't need it and didn’t like 


it. went on to explain that the WWF was 
and that on at least one Р t 
date he could not r ing. hi рб 
was asked to come t b7C 
ртр 
b6 
БУС 
b7D 
Investigation on 4/13/94 at New York, New York File # 196B-NY-234993 =— од 
(Telephonic) bE 
by . Date dictated 4/20/94 b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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according tol___|Concerning the request to buy cocaine, 
stated that he could not recall that event í: and if 


somebody else had re ic conversation, stated, b7D 
When questioned about the 
stated that that was 

that he 


The following is a description o 


Name: 

Employer: 

Date of Birth: b6 
Place of Birth: BUG 
Address: b7D 


Telephone Number: 


FD-36 (Rev. 11-17-88) Ç | 


FBI 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
[] Teletype ГІ Immediate L] TOP SECRET 
[J Facsimile Ë] Priority ГІ SECRET 
AIRTEL P] Routine ГІ CONFIDENTIAL 
z UNCLASEFTO 
UNCLAS y 


Date 


TO SAC, MINNEAPOLIS 
FROM DADIC, NEW YORK (196B-NY-234993) (P) (C-12) 


supsect { tba 
WORLD WRESTLING FEDERATION (WWF) 
ET AL | 
FRAUD BY WIRE, MAIL FRAUD - STEROID DISTRIBUTION 
OO:NY 


- 


Reference New York telephone call to Minneapolis, b6 
dated 6/15/94. D/C 


Enclosed under separate cover for Minneapolis are 


Po copy of the trial subpoena for witness 


For information of Minneapolis Division, New York 
Division has indicte 
company, TITAN SPORTS, INC., dba WORLD WRESTLING FEDERATION 
(WWF) with the illegal distribution of anabolic steroids. The 
trial of and the company is firmly set for July 5, 
1994 in e Eastern District of New York, (EDNY) at the 
Uniondale, New York Courthouse. 


- Minneapolis Searched ` 
J New York (196B-NY-234993) ' Serialized —— 


Indexed " 
WF:st filed 2222 


(4) 


Approved: : Transmitted Per 
(Number) (Time) 


w^ un 


O Q 


- 


196B-NY-234993 


who wrestled for under the 


wrestling talent name o 
i i indictment. 
important information concerning 
knowledge of steroid distribution and use of 

y WWF wrestling talent. 


On June 14, 1994, New York attempted to 
telephonically contact to arrange a pretrial 
conference and g estimony for the upcoming | 
trial. Although the telephone, he refused to 
any trial preparation and refused to testify at the upcoming 
trial. 


5, 194, Assistant United States Attorney 
аша) 8 888 Fequestša that[ be personally served 
with a trial subpoena to ensure that he is avail 

On June 15, 1994, NYO case agent]‏ ا 
sent via Lon ess an original and one co of a tria‏ 
ا а= [airectiy to‏ — 


[ hs described as follows: 


Name: 
DOB: 
Height: 
Weight: 
Race: 
SSAN: 
Address: 


Home telephone: 


MINNEAPOLIS DIVISION 


AT BLOOMINGTON, MINNESOTA: 


2* 


b6 
Dye 


рб 
bit 


b6 
І57С 


b6 
b7C 


b6 
DC 


at o 


O O 


Memorandum 


v 


To : SAC, II (196B-NY-234993) (P) Date 7/1/94 


TITAN SPORTS; b7C 
FBW; (DRUGS) STEROID ABUSE 


Captioned matter is scheduled to go to trial on July 5, 
1994 at the U. S. District Court, Uni h is in 
Nassau County., The prosecuting AUSA, Eastern 
District of New York, has requested that writer work over the 
July 4 weekend to include the holiday. 


Per attached letter, ausÀl  Ьав also requested b6 
that since writer resides in Tappan, N.Y. (Rockland County) and b7C 
will be required to work long hours before and after court 
sessions, he be authorized to reside along with the trial team 
members at a hotel near the court house. 


Therefore, it is requested that holiday pay by approved 
for July 4 and that writer be permitted to reside at a hotel 
during the week for the duration of the trial which is expected 
to take two weeks. 


pie Rr оре 


Enc1. 


1 - ASSC, WCC 


1 - CSSA, WCC 
ð- 196B-NY-234993 
- SUPV. C-12 SEARCHED ODED uu 
| \ Wis m 
азы йш EL n n /— 
(4) JUL 01 1994 


FB) NEW YORK 


4 61S e سانانا‎ “ 


o j U.S. етке of Justice 


~ United States Attorney 
Easter District of New York 


United States Auomey’s Office 2775 07 > 


1 Pierrepont Plaza 
бегі» Neg York 
William Doran 
Special Agerit in Charge 
FBI 
26 Federal Plaza Be ene Ж Ae - 
New York, New York 10003 Y b6 


b/c 


Dear Mr. Doran: 


As you may be awaré, the’ trial of the above captioned case 


is scheduled to commence on July 5 „Federal Courthouse, b6 
Uniondale, New York. Special Agen as been actively b7C 


engaged in both the investigation and pre-tr al preparation of this 
case for our office. j ы ЖАН Ж 


` 
ies ПЕ “< € 
Шы ot. - = 


It is crucial that Special Agent: sontinue to: assist inbó 


the prosecution of this matter due to his unique knowledge and UU SO 


experience with the witnesses and the evidenced: the.. government, intends 


to present, In this regard, I anticipate that Spécial Agent 


will be required to work a considerable number of hours both before 
and after court sessions, including weekends. 


Thus, based on the f iled above and due to the long 
distance between Special Agent а Uniondale, it isb6 
requested that you authorize Special Agent to reside with the рус 


other trial team members at a hotel near the courthouse for the 
duration of the trial. . 


I£ you have апу questions, feel free to contact me ° | 


be 


ZACHARY 
| DIC 


UNITED 


| Сои ОЎ Fraud 


w u... NG niece ғ... Ñ. шышы s 
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Special to The New York Times 

UNIONDALE, L.I., July 6 — A Fed- 
eral prosecutor today promised to 
expose “the dark, corrupt underbel- 
ly" of professional wrestling as the 
trial of Vincent K. McMahon, a wres- 
tling promoter, began in Federal Dis- 
| trict Court here. 

Mr. McMahon and his Titan Sports 
. Corporation, based in Stamford, г 
Conn., have been charged with illegal- 
ly distributing body-building steroids 
to performers ín Mr. McMahon's 
World Wrestling Federation. He 
faces an eight-year prison term and a 
$500,000 fine if convicted. 

In hís opening statement, the proses 
cutor, Sean O'Shea, said that steroids 
were distributed “ike candy" to 
World Wrestling Federation perform- 
, ers by Dr. George T. Zahorian, a 
Harrisburg, Pa., doctor. Dr. Zahoriamr 
obtained the drugs from the Rugby- 
Darby Pharmaceutical Company of 
| Westbury, L.I., Mr. O'Shea said, add- 
ing that Mr. McMahon and Titan 
Sports employees then engaged in an 
elaborate money-laundering scheme 
to hide the purchases they had made 
from Dr. Zahorian. 

Dr. Zahorian was convicted in 1991 
of illegally distributing steroids to 
professional wrestlers. He is expect- 
ed to testify for the prosecution on 
| Thursday. 


Some *Axes to Grind' 


But lawyers for Titan Sports and 
Mr. McMahon contended that the 
company had nothing to do with the 
purchase of steroids by Dr. Zahorian, 
his distribution of them or the wres- 
tlers' decision to use them. 

Laura A. Brevetti, a lawyer for Mr. 
McMahon, said in her opening re- 
marks to the jury, ‘You will not hear 
of shady figures on street corners or 
that there were children or teen- 
agers involved.” А 

Jerry S. McDevitt, the lawyer for 
Titan Sports, said that besides Dr. 
Zahorian's legitimate purchase of 
steroids from the Long Island drug 
wholesaler, the case was not connect- 
ed with the United States District 
Court, Eastern District of New York 
because the steroid sales to the wres- 
üers occurred in Pennsylvania and 
that anyway Titan Sports did not act 
improperly. He also said that former 
federation wrestlers scheduled to tes- 
tify for the prosecution “have axes to 
grind” against Mr. McMahon. ` 

Mr. O'Shea, the prosecutor, said 
Mr. McMahon “urged and cajoled 
wrestlers to take steroids" so they 
would have the muscular look that 
would appeal to audiences. But Ms. 


| Wrestling Promoter’s Trial ` 
On Steroids Charges Begins 


' steroids from Dr. Zahorian. 


Brevetti said that Mr. McMahon, sim- 
ply required that “his wrestlers be in 
shape, steroids or no steroids.” 

Besides Dr. Zahorian, the Govern- 
ment will call the wrestling superstar 
Hulk Hogan (whose real name is Ter- 
ry Gene Bollea) for whom, prosecu- 
tors say, Mr. McMahon specifically 
obtained: steroids. Mr. Hogan now 
wrestles for a rival organization, Ted 
Turner's World Championship Wres- 
tling Promotions. 

Other witnesses to be called by the, 
prosecution will include Doug Sages, - 
chief financial officer of Titan Sports, * 
and Emily Feinberg, Mr. McMahon’s 
former executive assistant, who. will, 
detail machinations, the prosecutors» 
say, at Titan Sports. 


Testifying of Drug Sales 


(Мг. McMahon, who underwent sur- 
gery last month for a herniated disk, 
sat in court listening to testimony 
wearing a heavy neck .brace. Also 
looking on was a mix of reporters, 


A prosecutor says -` 
drugs were 
distributed ‘like 
candy,’ 


girlfriends of testifying ‘wrestlers, 
and the curious. One wrestler, Afa the 
Wild Samoan, came by to lend moral 
support to Mr. McMahon.. 

After opening statements, the pros- 
ecution called two wrestlers who had 
had brief careers in the World Wres- 
tling Federation: Randy (Moondog 
Rex) Colley and Thomas Zenk. Both 
testified that Dr. Zahorian, who had 
been hired by the Pennsylvania Ath- 
Јейс Commission to examine wres- 
tlers, regularly sold the wrestlers ste- 
roids at shows in Hershey, Pa. 

“You took off your shirt, he exam- 
ined you, and you left with a bag of 
drugs if you paid for them," Mr. Zenk 
testified. But he said he never bought4 

Under cross-examination, both: 
wrestlers said that Mr. McMahon had 
not bought steroids for them or in 
structed them to take the drugs. 
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; ХО 89 (Rev. 11/91) Subpoena in Мпа! Case O 


- #9201488 nited States District Court 


EASTERN NEW YORK 
DISTRICT OF 


UNITED STATES OF AMERICA, 


SUBPOENA IN A 
V. ‘CRIMINAL CASE 
w = ж чё * 
AND 25 
ТІТАМ SPORTS, ІКС., | CASE NUMBER: 
Défendànts. ` 94 CR 1276(S-2) (JM) 
TO: | 
b6 
D7€ 


> . 2 - > $ ` 
зе. = > S А 


* 


KI YOU ARE, „COMMANDED to appear in the United States District. Court at the place, date, and time 
specified below to’ pele in- the above case: 
.PLACE : 


FEE 2 м 5 


COURTROOM 
(Mishler, J.) 
Courtroom 8, 


DATE AND Iy 7, 1994 
1:00 P.M. 


United States District ` Court 

Eastern District of New York: š 
2 Uniondale Àvenue s - 3 сз 
Uniondale, New York 11553- И 


b7c ` 


6/15/94 


(8y) Deputy Clerk 


ATTORNEYS NAME, ADDRESS AND PHONE NUMBER: 
USA, U.S. Attorney's Office, 1 Pierrepont Plaza, 
Brooklyn, NY | 


| tear uy- 2944993 — OF 


PLACE 


RECEIVED 12 


‘BY SERVER | Minneapolis, Minnesota 


Т FEES AND MILEAGE TENDERED TO WITNESS: 


[SERVED ON (PRINT NAME) ^^ — "^ 


AMOUNT 8. 


; Q,YES Ê NO 


^ SERVED BY (PRINT NAZE С Ë | 
Special Agent, ERT b7C. 
m — DECLARATION OF SERVER 
| | i declare under. penalty of perjury y under the laws. of the United States of America that the foregoing 
| information ‘contained in the Proof’ of Service is true and correct. | 
| о веш ЕКЕ ИН | [. | 
‚ ` М ! ` Date * ‘Signature of Server ` ы . ` NE ! ^ f 
۰ y ^ à Fo АМ Тал ecc elis ' 
"d Address of Server 


| ADDITIONAL INFORMATION ` 


N E 
_ Faw 


¿J 7 
FD-302 Rev. 3-10-82) 


=e 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 7 / 13 / 94 


date of birth 


was served Ете а trial subpoena at approximately 9:50 a.m. at 
his cresidenoa J = BB 


The su i а by Assistant United States Attorney b7C 
(AUSA) Eastern District of New York, and 
commanded appearance in United States District Court in 


New York on July 7, 1994, at 1:00 p.m. The criminal case number 
appearing on the subpoena is 94 CR 1276(S-2) (JM). 


interviewed telephonically by Special 
Agent at approximately 8:00 a.m. Г 


was informed of the identity of the interviewing Agent and that a Lë 
trial subpoena had been issued commanding his appeara j p7C 
Federal District Court in New York in a case ل‎ 


advised that he would not or service 
of the subpoena and did not wish to testify. lL ]instructed 
the interviewing Agent to "do what you have to do" regarding 
service of the subpoena. 


120% -Ay- 224292 — os 


[om с 


SERIALIZE sssi 


ШІ 2 f 1005 


Investigation on 6/17/94 at Bloomington, Minnesota Fief 196B-NY-234993 


SA b6 
by SA AJM:dJlk Date dictated 6/17/94 b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


FD-36 (Rev. 11-17-88) 


FBI 

TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 

[] Teletype L] Immediate LJ ТЕЕ ЅЕСВЕТ 

C] Facsimile O Priority O SE 

Kl] AIRTEL Û Routine o CONFIDENTIAL 
L] UNCLASEFTO 
L] UNCLAS 


Date 7/15/94 


TO DADIC, NEW YORK (196B-NY-234993) (C-12) 


FROM SAC, MINNEAPOLIS (196B-NY-234993) (RUC) 


SUBJECT 
dba WORLD WRESTLING FEDERATION (WWF), 
ET AL; de еу? 
FRAUD BY WIRE; L š i 
MAIL FRAUD ~ STEROID DISTRIBUTION (:° j^ 
OO: NEW YORK l gm 


Re New York airtel.to Minneapolis dated 6/28/94; 
New York telephone call to Minneapolis on 6/15/94; and 
Minneapolis telephone call to New York on 6/17/94. рб 


ІЗ ТЕ; 
Enclosed for New York is the original and two 


copies of an FD-302 setting forth the results of investigation 
conducted by Minneapolis on 6/17/94. Also 
New York is the original trial subpoena for 


dated 6/15/94. 


As there is no investigation remaining, Minneapolis 
considers this matter RUC. 


- New York (Encs. 4)6Y— 
2 - Minneapolis ' 
AJM:dlk 
(4) 


Approved: LC (f Transmitted Per 
(Number) (Time) 


RI 


е i s 
UJ € Ó О 
v FD-36 (Rev. 8-29-85) 
+ 


FBI 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
Teletype L] Immediate О TOP SECRET 
Ë] Facsimile ÛÛ Priority LJ 
Û] AIRTEL [X] Routine = 
" L] 
(Х] 


FM FBI NEW YORK (196B-NY-234993) (C) (C-12) 
TO DIRECTOR FBI/ROUTINE/ 

FBI PHILADELPHIA/ROUTINE/ 

BT 

UNCLAS 

CITE: //3540// 


PASS: ECONOMIC CRIMES UNIT, FINANCIAL CRIMES 


PHILADELPHIA HARRISBURG RA ATTN: SA б ` 4 
s b6 
SUBJECT: ы WORLD WRESTLING FEDERATION; DIC 


WWF; ET AL; ЕВИ; MF; OO:NY. 


ENCLOSED UNDER SEPARATE COVER FOR HARRISBURG R.A. IS THE 
b6 


ENTIRE TRIAL TRANSCRIPT OF THE | фа FROM JULY 5, 576 


1994, THROUGH JULY 15, 1994 IN THE EASTERN DISTRICT OF NEW 


YORK. 


T N E 8~ 


Searched 
]- 39 ерү; @-19. Serialized ГА 


[ndexed Канне с h y 
Fled AZ 41% 
(ӘНЕ: dae ГА 
Approved: LIne- / hk Original filename: > AX ( 0240 ' FOS 


Time Received: Telprep filename: S D. 20 Ó 


MRI/JULIAN DATE: _ <S ISN: | 


aw York 


FOX DATE & TIME OF ACCEPTANCE: | VAN, 


Ó O 


“PAGE 2 NEW YORK 196B-NY-234993 UNCLAS 


FOR INFORMATION OF BUREAU AND HARRISBURG,| | b6 
[ — |AND TITAN SPORTS INC. DBA WWF WERE ACQUITTED OF i 
CONSPIRACY TO DISTRIBUTE STEROIDS TO WRESTLERS. 
ON JULY 18, 1994, U. S. DISTRICT COURT JUDGE JACOB 


MISHLER DISMISSED TWO COUNTS OF DIRECT DISTRIBUTION OF 


— From[_ WHICH LEFF 


THE CONSPIRACY COUNT BE DECIDED BY THE JURY. AFTER TWO DAYS a 
OF DELIBERATION, THE JURY RETURNED A NOT GUILTY VERDICT ON 
BOTH THE CORPORATION AND| Î 

FOR INFORMATION OF HARRISBURG, JUDGE MISHLER INSTRUCTED 
THE PROSECUTOR TO NOTIFY THE GOVERNMENT PROSECUTOR IN THE 
[ — | TRIAL OF POSSIBLE OBSTRUCTION OF JUSTICE bé 
cHARGES.[ [TESTIFIED THAT HE WAS TIPPED OFF ABOUT THE bIC 
FBI'S MARCH 1990 SEARCH PRIOR TO IT HAPPENING, AND WAS 
INSTRUCTED TO DESTROY ALL CORRESPONDENCE BETWEEN (2 Даю 
THE WWF. 

рб 
NY WILL SUBMIT TRIAL TRANSCRIPTS TO CASE AGENT, Î b7C 


VIA FEDERAL EXPRESS AS PER INSTRUCTIONS OF FEDERAL JUDGE 
MISHLER. 


BT 


0073 MRI 01550 

RR FBINY 

DE FBINY #0019 2091929 

ZNR UUUUU 

R 2819252 JUL 94 

FM FBI NEW YORK (196B-NY-234993) (C) (C-12) 
TO DIRECTOR FBI/ROUTINE/ 

FBI PHILADELPHIA/ROUTINE/ 

BT 

UNCLAS 


CITE: //3540// 


PASS: ECONOMIC CRIMES UNIT, FINANCIAL CRIMES SECTION; BG 


PHILADELPHIA HARRISBURG RA ATTN: SA | b7C 
SUBJECT: | ОВА WORLD WRESTLING FEDERATION; 56 


b7C 
WWF; ET AL; FBW; MF; OO:NY. 
ENCLOSED UNDER SEPARATE COVER FOR HARRISBURG R.A. IS THE 
ENTIRE TRIAL TRANSCRIPT OF ТН [TRIAL FROM JULY 5, 
1994, THROUGH JULY 15, 1994 IN THE EASTERN DISTRICT OF NEW ae 
YORK. D 


FOR INFORMATION OF BUREAU AND HARRISBURG, ИШЕ 


е Ny -221173 — 57 


Searched —————— 
Serialized e 

Indexed 

Filed 


О Q 


PAGE TWO DE FBINY 0019 UNCTAS 
(Амр TITAN SPORTS INC. DBA WWF WERE ACQUITTED OF x 
CONSPIRACY TO DISTRIBUTE STEROIDS TO WRESTLERS. 

ON JULY 18, 1994, U. S. DISTRICT COURT JUDGE JACOB 


MISHLER DISMISSED TWO COUNTS OF DIRECT DISTRIBUTION OF 


sreroros rmon) Jeo CH LEFF b6 


THE CONSPIRACY COUNT BE DECIDED BY THE JURY. AFTER TWO DAYS DI 
OF DELIBERATION, THE JURY RETURNED A NOT GUILTY VERDICT ON 
BOTH THE CORPORATION aND| — |] 
FOR INFORMATION OF HARRISBURG, JUDGE MISHLER INSTRUCTED 
THE PROSECUTOR TO NOTIFY THE GOVERNMENT PROSECUTOR IN THE b6 


NENNEN S OF POSSIBLE OBSTRUCTION OF JUSTICE b7C 


CHARGES. || _ jresrrrrEp THAT HE WAS TIPPED OFF ABOUT THE 
FBI'S MARCH 1990 SEARCH PRIOR TO IT HAPPENING, AND WAS 


INSTRUCTED TO DESTROY ALL CORRESPONDENCE BETWEEN [ Jab 


THE WWF. bE 
NY WILL SUBMIT TRIAL TRANSCRIPTS TO CASE aceNT[ — ] DIC 

VIA FEDERAL EXPRESS AS PER INSTRUCTIONS OF FEDERAL JUDGE 

MISHLER. 

BT 


#0019 


NNNN 


FD-515 (Rev.1-1-93) Су Accomplishment Report O Report Date: 7 / 22, Fy 


2 (Submit within 30 days from date of accomplishment) 
I From: ACT С 


check all that арр! 
Drugs 
A Fugitive 
Bankruptcy Fraud 


(m) 
Ci 
D 
Computer Fraud/Abuse m 
D 
Г] 


File Number Investigative Assistance or Technique Used 


|/44- 231943 | 1 = Used, but did not help 3 = Helped, substantially 


2 = Helped, minimally 4 = Absolutely essential 


Stat Aqent_Soc. Seç. No. 
IAT 


Informant Info. Tech. Agnt. or Equip. 
тавро Tol Recs, 
Lab. Div. Field Supt. 


Corruption of Public Officials 
Forfeiture Assets 


ELSUR/ FISC 
Eng. Sect. Tape Exams Show Money Usage 
EL ns, 
б?) approval (please initial) V Assi 
7 
Accomplishment type ° SerialNo.ofFD-515  . 
Дол l1 ZAI || 
A. Complaint / Information / Indictment D. Recovery / Restitution / Potential Economic Loss Prevented (PELP)x * 
Also Complete Section I Recovery 
Serial number : П Federal DJ Local 
Check if Civil / Rico Complaint [7] 


Assisting Joint Agencies X * 
1. U-6 - flu a fed 


Restitution 
В. Arrest/ Locate / Summons ( Court Ordered 


Arrest 0 Pretrial Agreement’ 
©) Federal D Local Ф 
Subject Priority: ПА OB OC А F. АРА Payment 
ПІ Subject Resisted . Civil / Rico Matters Amount: $ 
[1 Subject was Armed Also Complete Section I 
Locate Date of Complaint, —/  / ^ G. Administrative Sanctions 
Subject Priority: OA OB OC Judgment ^ ° Type: Length: 
Summons Judicial Outcome ____х» D Suspension Г] Permanent 
ËJ Federal О Local ¢ Fines: $ D Debarment CJ [Years | Months | 
C. Hostage(s) Released Û Injunction рты 
. : | Years | Months | 
Released by: С] Terrorists | (7] Other Suspension: 
Number of Hostages: Subject Description Code: ff. Й ° 


H. Final Judicial Process I. U.S. Code Violations 
Conviction 
Also Complete Section I 
Date of Complaint, Information or Indictment:: l NN б / 42 
Date of Conviction: / / 


Date of Sentence:. Ld Federal 
Subject Description Code: _ ° [1 Locale Required for Sections A, E, and H (Conviction) 


Judicial State: District: 


| : Optional for Section B (arrest) 
Sentence type: — X* . D кй adf — 
Sentence Term: L) Mis 2 Каина! )Dismissal / Pretrial Diversion б, 
ТІГІ Probation Plea Date of Indictment or Information: 42 ; (9; RY 
es inm [yen E me Pes Ы Trial Subject Description Code: ў. 7 fr y-25 


Searched 
Seríalized 
J. Subject Information (Required for Sections A, B, D (Restitution), E, F, G, and H) ndexe Ч 


рб 
Г] Subject Related to an LCN, Азап Огдапігед Crime (АОС), or Italian Organized Crime (IOC) Group. (if checked, also submit form FD-515a) 


X Additional information may be addéd by attaching another form or a plain sheet of paper for additional entries. 
* Requires that a written explanation on plain paper be attached. (Court Ordered Restitution does not require a written explanation) 
* See codes on reverse side. 


ACCOMPLISHMENT TYPES 


Complaint 
Information 
Indictment 

Arrest 

Locate 

Summons 
Hostage(s) Released 
Child Locate 


Civi/RICO 

AFA Payment 
Admin. Sanction 
Conviction 
Pretrial Diversion 
Acquittal 
Dismissal 


PELP CODES 


22 Counterfeit 
Stocks/Bonds/Currency/ 
Negotiable Instruments 

23  Counterfeit/Pirated 

Sound Recordings or 
Motion Pictures 
Bank Theft Scheme Aborted 
Ransom, Extortion or Bribe 
Demand Aborted 

26 Theft From or Fraud Against 
Government Scheme 
Aborted 

27 Commercial or Industrial 
Theft Scheme Aborted 

30 All Other 


RR 


ORGANIZED CRIME 
SUBJECTS 


1F Boss 

1G Underboss 
1H Consigliere 
17 Acting Boss 
ІК Capodecina 
1L Soldier 


KNOWN CRIMINALS 


2A Top Ten or LO. Fugitive 
2B Тор Thief 
2C Top Con Man 


FOREIGN NATIONALS 


„ЗА. Legal Alien A. [z 

3B Illegal Alien 7 ——. 

7$C-'ForigrOffial Wout ' ° ° 

ж - Diplomatic Immunity, — " 06500 

3D ШЫ, Employee Wout hnj] 
Diplomatic Immunity ` 

3E Foreign Student 

3F All Others 


OTHERS 
ЗА АП Other Subjects 
8B Company or Corporation 


——'* US: GOVERNMENT PRINTING OFFICE: 1993 342-484/72323 


PROPERTY CODES 


01 Cash 

02 Stocks, Bonds or Negotiable Instruments 
03 General Retail Merchandise 

04 Vehicles 

05 Heavy Machinery & Equipment 
Aircraft 

Jewelry 

Vessels 

Art, Antiques or Rare Collections 
Real Property 

All Other 


S229988 


JOINT AGENCY CODES 


BATF Bureau of Alcohol, Tobacco and 
Firearms 

DEA Drug Enforcement Administration 

DOI Department of Interior 

FAA Federal Aviation Administration 

INS Immigration and Naturalization 
Service 

IRS Internal Revenue Service 

NBIS National NARC Border 
Interdiction 

RCMP Royal Canadian Mounted Police 

USBP U.S. Border Patrol 

USCS U.S. Customs Service 

USDS U.S. Department of State 

USTR US. Treasury 

ST State 

LOC Local 

OTHR Other 


SENTENCE TYPES 
CP Capital Punishment 


JS Jail Sentence 
LS Life Sentence 


NS No Sentence (Subject Died or is Fugitive) 


PB Probation 
SI Suspension of Jail Sentence 
YC Youth Correction Act 


SUBJECT DESCRIPTION CODES 


TERRORISTS 


4A Known Member of a 
Terrorist Organization 

4B Possible Terrorist Member 
or Sympathizer 


UNION MEMBERS 


50 President 

SE Vice-President 

SF Treasurer 

56 Secretary/Treasurer 
SH Executive Board Member 
SI Business Agent 

5J Representative 

SK Organizer 

SL Business Manager 
SM Financial Secretary 
SN Recording Secretary 
SP Office Manager 

5О Clerk 

SR Shop Steward 

55 Member 

ST Trustee 

SU Other 


7B Bank Employee 


JUDGMENT CODES 


CJ Consent Judgment 

CO Court Ordered Settlement 
DF Default Judgment 

DI Dismissal 

JN Judgment Notwithstanding 
MV Mixed Verdict 


‘SJ Summary Judgment 


VD Verdict for Defendant 
VP Verdict for Plaintiff 


JUDICIAL OUTCOME 


AG Agreement 

BR Barred/Removed 

CC Civil Contempt 

DC Disciplinary Charges 
FI Fine 

PI Preliminary Injunction 
PR Temporary Restraining Order 
RN Restitution 

SP Suspension 

VR Voluntary Resignation 
OT Other 


RACE CODES 


B Black 

C Chinese 

I  Indian/American 
J Japanese 

O Other 

U Unknown 

W White 


For Further Instructions See: 
MAOP, Part II, Section 3.3-5, 


GOVERMENT SUBJECTS 


GA Presidential Appointee 

6B US. Senator/Staff 

6C U.S. Representative/Staff 

6D Federal Judge/Magistrate 

6E Federal Prosecutor 

6F Federal Law Enforcement Officer 
6G Federal Employee - GS 13 & Above 
6H Federal Employee - GS 12 & Below 
6J Governor 

6K Lt Governor 

6L State Legislator 

6M State Judge/Magistrate 

6N State Prosecutor 

6P State Law Enforcement Officer 
6Q State - All Others 

6R Mayor 

6S Local Legislator 

6T Local Judge/Magistrate 

60 Local Prosecutor 

6V Local Law Enforcement Officer 
6W Local - All Others 

6X County Commissioner 

6Y City Councilman 


BANK EMPLOYEES 


7A Bank Officer 


Е © О 


Scrolling performed 


08/08/94 ***** Acquittal Information ***** FAAMAAO1 
SENSITIVE / UNCLASSIFIED 4 more » 

Case File Number. . : NY0234993 196B (SN) 

Field Office. . . . : NY Rpt Date. . : 08/08/1994 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 
Current Processing Mode: ADDING RECORD 


Name subject . . »4 |] x 
ame Subject NS 


Does This Accomplishment Involve: BZC 


Drugs (Y/N) < x < X w «oU боже ао Lowe ы жж SON 
A Püudltive (Y/N). 3-5,4 э. е ж жоя а езе a cw ce ж SSN 
Bankruptcy Fraud (Y/N). . esses + < < + o oeo. >> N 
Computer Fraud/Abuse (Y/N). . . . . + + + + + © + + =* >> N 
Corruption Public Officials (Y/N) . . . . . . + + + + >> N 
Forfeiture Asset (Y/N). . . . . . + +s +s + © + © + © + >> N 


Classified By: 
SENSITIVE / UNCLASSIFIED Declassify On: 
РЕ1=Не1р PF3=Exit PF4=Pmpt PF5-Indx PF7=Bkwd PF8=Fwd PF9=Quit PF10=Left 
PF11=Right PF12=Main 


4BÜ Aa B0--W7313102 R9 C 59 20:11 8/05/94 
Scrolling performed 
08/08/94 ***** Acquittal Information ***** FAAMAAO2 
< 1 more SENSITIVE / UNCLASSIFIED '3 more » 
File Nbr . . : NY0234993 196B (SN) 
Field Office . . : NY Rpt Date . . : 08/08/1994 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 
Serial Number of FD-515. . > 

SOC Agent Claiming Stat. . ыыр лут jx b6 
RA/Squad Claiming Stat . . >> D2.. / C12. + 


Task Роксе 5 4 4 e o9 < 45% + dis 
Assist Joint Agencies. . . > OTHR. + ..... ж» rere wd ik 
Assisting Agent SOC. . . > 1... = .. = .... +X 
(MAX 12) ddp ue ees 
M PUE ا‎ ees 
DAMM MU S 
D. yaq s SS unser me odas 
cL a t 
d oue. НЧ 
B qe CU. “шек 
Classified By: 
SENSITIVE / UNCLASSIFIED Declassify On: 
РЕ1-Неір PF3=Exit PF4=Pmpt PF5-Indx PF7-Bkwd PF8-Fwd PF9=Quit PF10=Left 
PF11=Right PF12=Main 
4BU Aa B0--W7313102 R7 C 32 20:11 8/05/94 
Scrolling performed 
08/08/94 ***** Acquittal Information ***** FAAMAA17 
« 2 more SENSITIVE / UNCLASSIFIED 2 more » 


Field Office . 
RA/Squad Code. 
SOC Stat Agnt. 
Subject. . . . 


File Nbr. . NY0234993 196B (SN) 


C12 Ере Date . . : 08/08/1994 
Stat Aqnt. . : b6 
(SN) b7C 


о = 
NK 


€ © о o 
oe 99 99 oo 


© О 


Yee Ede dee de e e e de e ee ee eee dee ملو ملو‎ e ke ee e eee ee ee ee eee e III II dee eee de de ede de eee e dede de dee e با یاج یاج یلج ملو‎ ede dede 


Date of Acquittal or Dismissal (MM/DD/YYYY). . >> 07 / 22 / 1994 ) 


Classified Ву: 
SENSITIVE / UNCLASSIFIED Declassify On: 
РЕ1=Не1р PF3=Exit PF4=Pmpt PF5=Indx PF7=Bkwd PF8=Fwd PF9=Quit PF10=Left 
PF11=Right PF12=Main 


4BÜ Aa BO--W7313102 R 10 C 54 20:11 8/05/94 
Scrolling performed 
08/08/94 ***** Acquittal Information ***** FAAMAA21 
« 3 more SENSITIVE / UNCLASSIFIED 1 more » 


Field Office . NY File Nbr . . : NY0234993 196B (SN) 


RA/Squad Code. . : Rpt Date . . : 08/08/1994 b6 
SOC Stat Agnt. . : at Aan 2. 

Subject. . . . . : (SN) b/C 
kkk kk اج یلو یاج با یاو باو باو‎ kkk kk e ede dede e dee dee dee de dede dee eee dede dede باو یلو یلو او‎ dee К 
Accomplishment Narrative: Clear Screen (X) . . > . 


@ ° o ө ө e ө ө е @ э ө 5 @ ө ө ө ө a a ө @ @ ө @ @ @ @ @ 0@ 0@ 0 ө ө ө @ ө ө @ ө @ 0@ @ @ @ @ ө @ @ @ э 0@ © ө @ ө Ф ө @ ө o ө ө Фо ө ө ө ө ө ө 
@ ° @ ө ө ө ө @ ө ө ө ө @ @ ө ө 9 ® @ э @ ө ө ө э ө ө @ ө ө ө @ 9 ө ө ө ө ө ө ө oe ө ө ө ө ә 0 ө 09 э ө ө ө ө 0@ ө ө ө ө @ өэ ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө 
€ ° 9 9 9 ө * € ө € 6 9 э ө ө * * € ө ө ө ө 9 ө ө ө ө ө 9 6 ө ө 9 ө 6 ө € ө € ө € ө € € 9 € 0 € ө ө € € ө ө € € ө ө ө ө ө ө ө € ө * 6 ө ө ө ө ө 6 e ө € 
€ * 9 ө * ө @ 9 ө € ө * ө ө ө ө € @ € э ө ө ө ө ө 6 ө 9 ө ө ө ө € 9 € ө € € 9 € ө ө ө € ө ө ө € € ө ө @ ө ө @ ө @ 6 € өэ ө ө € ө ө @ * ө ө * ө 6 6€ ө * о 
@ ° о ө e ө ө ө @ @ ө ө @ ө ө ө ө ө @ ө ө ө 9 ө 0 ө @ ө @ ө ө ©ө© ө ө ө ө ө ө ө @ ө ө ө ө 09 ө ө ө ө @ ө ө ө @ @ © @ @ € ө ө ө ө ө ө € ө э ө ө ө ө ө ө ө » 
* ° о ө ө ө ө ә @ ө ө э @ ө ® е ө ө ө ө ә ө ө ө ө ә э ө ө @ ө ө э ө ө е ® ө ө ® ө ө ө 0 ө ө е ә э ө ө ө ө ө ө е ө ө е ө ө ө @ @ @ € ө ө @ ө ® ө o ө ө ө 
° e oe o o e o o e ө ө o ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө o ө ө ө ө ө ө ө ө ө ө 0 ө ө ө ө o ө oo ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө 


@ ° ° о ә ө ө өе ә ө ө ө ө ө ө ө ө ө ө ө ө e ө э ө ө ө ө 9 ө ө ө э ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ө ® @ @ ө ө @ ®'о @ © ө ө ө @ ө ө ө ө ө ө ө ө ө 


Classified By: 
SENSITIVE / UNCLASSIFIED Declassify On: 
РЕ1=Не1р PF3-Exit PF4=Pmpt PF5-Indx PF7-Bkwd PF8=Fwd PF9-Quit PF10-Left 
PF11=Right PF12-Main 


4BU Aa BO--W7313102 R9 C 67 20:11 8/05/94 
Scrolling performed 
08/08/94 ***** Acquittal Information ***** FAAMAA22 
< 4 more SENSITIVE / UNCLASSIFIED 
Field Office . . : NY File Nbr . . : NY0234993 196B (SN) 
RA/Squad Code. . : D2 c Rpt Date . . : 08/08/1994 
SOC Stat Agnt. . : Stat Aqnt. . : 


Subject. . . . . (SN) 
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Rating: 1 No Help, 2 Minimal, 3 Substantial, 4 Essential Clr Scr (X) . . »b7C 
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ІМАМ ANALYST NFORMNT INFO ECH AG/EQUIP | 
IRCRAFT ASST B DIV EXAMS EL TOLL RECS 
OMPUTER ASST B FIELD SUP CO-GROUP I 
ONSEN MONITR EN REGISTERS CO-GROUP ТТ 


LSUR/FISC HOTO COVERGE CO-OTHER 


y | О 


LSUR/III OLYGRAPH NCAVC/VI-CAP 
ENG FIELD SUP RCH WAR EXEC VISUAL INVEST bé 
ENG TAPE EXAM HOW MONEY CRIS NEG-FED 
HYPNOSIS ASST OG ASST CRIS NEG-LOC b7C 
WAT TEAM ERT ASST b7E 
Classified By: 
SENSITIVE / UNCLASSIFIED Declassify On: 


PFl-Help PF3=Exit PF4=Pmpt PF5=Indx PF7-Bkwd PF8=Fwd PF9-Quit PF10=Left 
PF11=Right PF12=Main 
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ud 
FEDERAL BUREAU OF INVESTIGATION 


7/22/94 


Date of transcription 


—— Ye male, Date of 2 
Birth: was telephonically contacted. ГГ“ Ммаѕ ; 


advised of the identity of the interviewing agent апа the purpose b 7! 
of the interview. [1 
information: 


voluntarily provided the following 


scribed himself 


b6 
b /C 
b7D 
knowl] пе was а сЕ when 
b6 
b7C 
b7D 
e_person at who 
b6 
hy 
(telephonically) 
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SA dks/ Date dictated 7/13/94 Dc 
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knows lL ie met her when he was b7C 


doing the 
represented 


The only time 


other miscellaneous matters. 


m Q Q 
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196B-NY-234993 


Continuation of FD-302 of [ | .On 7/12/94 Page. 3. 
[ — again advised that[ — — J] 


would be the person that knew the most abou 
dealings. 


At one point in the interview,|| |  ]askea this agent 
if she had read icles in the New York Obseryer and the New 


York Post about - When asked by this agent i 
anything to do with the articles[ ^ ]repiied "no". 


commented that the New York Post article was spicier. 


In closing j could be contacted 
tomorrow at telephone number 


Memorandum 
To : SAC, II (196B-NY-234993) (С) Date 9/21/94 
b6 
Bm: sa[ ^ |(с-12) b7C 
Subject: ET AL 
FBW; MF 
OO: NY. 


Re: File review dated 9/14/94. 


As a result of subject[ еселе acquittal in b6 
connection with above captioned case; and the fact no other b7C 
investigation exists in connection with this matter, it is 
requested that this case be closed. 


DUPLICATE SERIALS 
DESTROYED ON allt 


BY 


С9- 196B-NY-234993 
1 - Supv. С-12 


1%е-ну-23442з — 70 
SERED — INDEXED rr. 
СТ 


беш — 2 rio 
ЗЕР 22 1994 
FBI-- NEW YORK 


WMF:da 
(2) 


о C 


(12/31/1995) 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 12/21/1999 
To: | FBIHQ Attn: bá 
FOIPA Section, 
Room 6941 оте 


+ 


(СЭЛ York 
Legal Unit/FOIPA Section 
"9 СойасбГ | 


Case ID d: FOIPA Number 910438 
(190-NY-234993) 


Title: World Wrestling Federation - Subject 
eques 


Synopsis: Main file for forwarding to FBIHQ. 
Enclosures:  196B-NY-234993: 


Details: Per communication from FBIHQ, dated 12/7/99, New York 
is forwarding the above-captioned closed file for processing. 


consists of 2 main volumes and one Sub b7D 
F totaling approximately 600 pages. 


LIU 23999 We 


jo em due Ө- 
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اما ^ ' 


ES 
e ctu 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE ` Date: 11/01/2008 


To: Ме or Attn: Evidence Control Unit 


From: New York 
Squad C-12/B bó 
Contact: FA b7C 


Approved By: 


Case ID #: 196B-NY-250517 ® | 
. 196р-МҮ-249606 (39% 


196D-NY-225452 
196B-NY-233872 
LICKENYEPITI OD» 
295C-NY-260717 


Title: DESTRUCTION OF 1C's 


Synopsis: Destruction of 1C's. 


Details: It is requested that the below-listed 1C's from closed 


case files be destroyed. The investigations have been concluded 
and therefore there is no need for retention of these 1C's. 


Case File Number 1C Number Barcode i 
196B-NY-250517 1С1 Е0740981 
196D-NY-249606 1C1 E0740608 
196D-NY-225452 161 
196B-NY-233872 1C1 

1C2 

1C3 
196B-NY-234993 1C1 


295C-NY-260717 1C1 
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"Date of transcription’ -— LA Š ^ cines 


telephonically contacted 
in Phoenix, Arizona, telephone number 


in. мге of the United; Attorney's 
Office and described the various documents . to. SA | 


+һеве "docüsients: which | 
айа figured: that s 
per written instructions: enclosed. 
statëd no and asked: if there were: any. 
and World Wrestling; Federation.” : 
enclosed in the. -packages advised -: 
that there mig Е be. SN ^ |Еһеп advised that he would have to. 
call pofte he attempted to. intercept: ‘the: package: from 
Investigator A time was set by Sat S re-coéntact 
at 3:00 p.m., New York time, on March 25, 1994. 


At approximately 3:00 p.m. the same 
contacted | La: the above number and asked 


knew 


Attorney 


says something, you do not | 


Investigation on 3/25/94 at Brooklyn, New York File #! 196B-NY-234993 b6 
(Telephonic) ° b7C 
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by sal шы -Date dictated, 3/25/94 2% 
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(Rev. 01-31-2003) 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 05/04/2006 b6 
576 
То: Мем Haven Attn:  Bulky Evidence Custodian 


From: New Haven 
BRA-1 


———— a 


Drafted By: [+] ЕС 920. 


Case Ір #: 196D-NH-42441 (Pending) 


2-72. 


Title: 


BELL CONSULTING; 
WORLD WRESTLING ENTERTAINMENT (WWE) - VICTIM 


Synopsis: Remove a portion of 1B3 from evidence. 


Details: On April 27 


ortion of Bo EGJ 


Therefore, 


rom the inventory. 
were copies and the originals are in the 


custody of WWE's attorneys. If additional copies are needed, 
they will be requested. 
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(Rev. 01-31-2003) 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 08/23/2007 
To: New Haven Attn: 


From: New Haven 
Bridgeport RA, BRA-1 bé 


Case ID #: 318A-NH-42441 (Pending) EE 
Title: 
WORLD WRESTLING ENTERTAINIMENT (WWE) - VICTIM 


Synopsis: To close above mentioned investigation. 


Details: On May 1, 2007, ы ере 


sentenced by 0.5. District Court Judge Stefan R. Underhill in 
Bridgeport, Connecticut. А11 the evidence for this matter has 
been disposed. Thus, there being no further investigative action 
needed, it is requested that this matter be closed. 2 


é 


235 JL D OG. EL. wed 


AEA. o p _ 


FD-302 (Rev. 10-6-95) 


(AUSA) 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/04/2006 


On Apri 006, Assistant United St 
and Special Agent (SA) of be 
the Federa ureau of Investigation (FBI) viewed evidence at the ртс 


Investigation on 


File # 196D-NH-42441 “3 


by SA 


U.S. Attorney's Office in Brideport, Connecticut in the below 


were damaged 


b3 FGJ 
amage 
04/27/2006 a Bridgeport, CT 
Date dictated 05/04/2006 m 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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| kx 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/18/2006 I 


2 


5 


for the HUDSON UNITED 


and cellular TE E E telephonically 
interviewed.  Aftér being advised of the identity of the 52Р. 
interviewing agent and the nature of the p E 

provided the following information: 


ева to work fo K (SUMMIT). SUMMIT 
was acquired by FLEET BANK (FLEET). ] — ise his employment 
at SUMMIT before FLEET'S acquisition was completed. 
left SUMMIT and began working at HUDSON U 


UNITED). He has worked for HUDSON UNITED 


| [reviewed checks number 259 
i e drawn on the FLEET account of 
(SSAI). Upon reviewing these checks, 


was able to provide a description of the process which these checks 
undergone for funds to clear from SSAI'S account to 
F BELL CONSULTING, LLC account. 

The payee of the check provided the check and a deposit 
slip to the teller at a HUDSON UNITED branch in Connecticut. The 
teller would "key" the information into his/her HUDSON UNITED'S 
"Audit Trail" program on his/her terminal. This program is a 
teller journal that tracks all of the teller's transactions. The 
teller would then place the check and the deposit slip into a pile, 
in the same condition as it was received, with all of the other 
checks received by the teller that day. At the end of the day, the 
checks and deposit slips were placed into a secured bag and the bag 
is locked. A courier, at the time BEAVER EXPRESS, would collect 
the bags from the branch and drive them to M&I, now METAVANTE, 
which was a company that HUDSON UNITED used as a third party item 
processor. Mé&I'S processing center was located in Fairlawn, New 
Jersey.  BEAVER EXPRESS was a Connecticut company and wa | 


At M&I, someone would receive the bag from the courier 
and scan the bar code on the bag. Then the bag would be unlocked 
and the checks would be placed into a sorter machine. After the 
checks were dropped into the "hopper," an image was taken of the 
check. The check would then continue on the conveyer belt into the 


Investigation on 05/18/2006 a Bridgeport (telephonically) 
File # 196D-NH-42441 + 22 Date dictated 05/18/2006 
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pocket line. The machine would read micro data along the bottom o£ 
the check, which was typed in magnetic print. The machine would 
read the routing number and place the check into the appropriate 
"pocket." bottom line of these three checks appears the 
saber | This number told the machine that this check was 
a FLEET check. nce the machine determined the routing number, the 
check would fall into one (1) of the twenty-four (24) "pockets" 

in order to go to FLEET'S item processing center. However, these 
three checks actually passed to the Second District's FEDERAL 
RESERVE in East Ruthersford, New Jersey and did not go to FLEET'S 


item processing center. The check would have left M&I to go to the 
FEDERAL RESERVE via courier. 


Upon receipt, the FEDERAL RESERVE would put the check 
into its own processing machine. The FEDERAL RESERVE'S machine has 
its own "pockets." The check would be sorted into the appropriate 
"pocket." When the FEDERAL RESERVE finished processing the check 
it was sent to FLEET'S Operation Center in Connecticut. 
believed that it was located in Hartford, Connnecticut. 


Upon receipt, FLEET would, also, run the check through a 
Sorter. The image and data would be captured and the machine would 
create a posting file to represent a post on the account.  FLEET 
would have twenty-four (24) to forty-eight (48) hours to determine 
if there is sufficient funds to honor the check. 


реце that LAFAYETTE-AMERICAN BANK was a 
Connecticut based institution and that iteprocessed its checks in 


Connecticut. HUDSON UNITED BANK acquiséd LAFAYETTE AMERICAN BANK. 


(Accomplishment must be reported and loaded into ISRAA 


Squad supervisor approval within 30 days from date of accomplishment) 


4 (please initial) 


keeómplishment involves: 
(check all that apply) 


Drugs L1 
A Fugitive Г] 
Bankruptcy Fraud 0 
Computer Fraud/Abuse (1 
Corruption of Public Officials 
Money Laundering 

Sub Invest Asst by FO (s) 


File Number 


1-Used, but did not help 
2 -Helped, minimally 
For Sub. Invest. Assist. by other FO ( 


IAT Rate FO 


OOO 


Assisting Agencies x * 


A. Complaint / Information / Indictment Е Conviction J. 
Je Federal [7] Local [ ] International C] Federal [] Local [ International 
Complaint Date: _ 1. Conviction Date: 


18 37l um L. 
C. Summons Date: _  .— | ç WK 23314 $2. —3 


D] Federal Г] Local 


D. Recovery/Restitution/PELP X 
О Federal Ц] Local [] International 


Recovery Date: H. Sentence Date: 

Code *____/ Amount $ — Sentence Type: ыт ті: ° M: 
oode “___¥ Amount $ In Jail: Years Months 

Restitution Date: 2 U lt Suspended: Years Months 

[Г] Court Ordered [Pretrial Diversion Probation: “Years Months N. 
Code * V Amount $ Fines: $ i 

PELP Date: 

Code ° V Amount $ 


1. Disruption/Dismantlement: v/ 

E. Hostage(s) Released Date: Disruption Date: 
Released by: [ ] Terrorist О Other i 9. 
Number of Hostages: Dismantlement Date: 

Completion of FD-515a Side 2 Mandatory 


For Indictments/Convictions only: 
Subject related to an LCN, Asian Organized Crime (АОС), Italian Organized Crime (IOC), Russian/Eastern European, 
Complete FD-515a, Sidg/ Blocks A-E mandatory, Р-Н as appropriate. 


Complete FD-515a, Side 1 Blocks A-C only. 


X Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 
* Seecodes on reverse side. 


V Requires that an explanation be attached and loaded into ISRAA for recovery over $1m and PELP over $5, disruption, dismantlement. and drug seizures. 


80-4. Чә YY /- BD 


(Rev. 7-16-02) qus Accomplishment Report es 


Investigative Assistance or Technique Used 


кж А | Judgment ij 
Check if Civil Rico Complaint Г] Subject Description Code: «( ) pou 22. — — --- ae 
Information Date: 2-0 For 6F, G, H-Include Agency Code Amount $ 
Indictment Date:_Ob/6le/9606, C] Felony or ГІ Misdemeanor Suspension: Years Months 
B. Locate/ Arrest ПІ Plea or П Trial 
D Federal [J Local [J International State: Judicial District: K. Administrative Sanction Date: 
Subject Priority: OA OB [1C Subject Description Code "° 
Locate Date: G. U.S. Code Violation “з spension o anni 
Arrest Date: Required for sections A,B,F,and J ГІ Debarment or 
ГІ Subject Resisted Arrest (Federal Only) | [Г] Injunction | Year Months 
П Subject Arrested was Armed Title Section # Counts 


P. Subject Information - Required for/Áll blocks excluding block D (Recovery/PELP), blocks E, I, L, and N. 


Sex | Date of Birth | Social Security No. (if available) 
а [м tC 


[] Subject related to an QC/Drug Organization, а VCMO Program National Gang Strategy target group, or a VCMO Program National Priority Initiative target group - 


Date Prepared 
Date Loaded 
Data Loader's Initials 


3 - Helped, substantially 


4 - Absolutely essential 
S) indicate A,B,C,D for corresponding FO 


Rate FO Rate FO IAT 


IAT 
ИСО - GroupI B 2908! 
[роо ооо | Mire Lang Asst | 
| uco -nat Ba | E 
со | 
‚ o Wanted Fyer 


Crisis Neg. - Fed. 


Crisis Neg. - Local CART 
ERT Asst Asset Forf Prog 


Butte - ITC Forf Support Projj ` 


Civil Rico Matters Date: 
Also Complete "Section G" 
Other Civil Matters Date: 


Asset Seizure Date: 

Asset Forfeiture Date: 

CATS £ Mandatory 

Circle below one of the three asset forfeiture: 
Admin, Civil Judicial, or Criminal 

Do not indicate $ value in Section D 


Acquittal/Dismissal/Pretrial Diversion 
(circle one) Date: 


Drug Seizures / Date; 

Drug Code * 

Weight Code * 

FDIN 

Do not indicate $ value in Section D 


Child Victim Information 
Child located/identified Date: 
O Living ПП Deceased 


Caribbean, or Nigerian Organized Crime Group - 


Serial No. of FD-515 
22 


PROPERTY CODES 


0 Cash 
02 Stocks, Bonds or Negot. Instruments 
03 General Retail Merchandise 


04 Vehicles 

05 Heavy Machinery & Equipment 
06 Aircraft 

07 Jewelry 

08 Vessels 


09 Art, Antiques or Rare Collections 
п Real Property 
20 All Other 


SENTENCE TYPES 


CP Capital Punishment 

JS Jail Sentence 

LP Life Parole 

LS Life Sentence 

NS Мо Sentence (Subject is a Fugitive, 
Insane, has Died, or is a 
Corporation) 

PB Probation 

SJ Suspension of Jail Sentence 

YC Youth Correction Act 


PELP CODES 


22 Counterfeit 
Stocks/Bonds/Currency/ 
Negotiable Instruments 

23 Counterfeiv/Pirated Sound 
Recordings or Motion Pictures 

24 Bank Theft Scheme Aborted 

25 Ransom, Extortion or Bribe 
Demand Aborted 

26 Theft From or Fraud Against 
Government Scheme Aborted 

27 Commercial or Industrial 
Theft Scheme Aborted 

30 Al! Other 


ORGANIZED CRIME 


SUBJECTS 

IF Boss 

IG Underboss 
1H Consigtiere 
и Acting Boss 
IK Capodecina 
IL Soldier 


KNOWN CRIMINALS 


2А Top Ten or 1.0. Fugitive 
2B Top Thief 
2C Top Con Мап 


FOREIGN NATIONALS 


3A Legal Alien 

3B Iitegal Alien 

эс Foreign Official W/out 
Diplomatic Immunity 

3D U.N. Employee Мош 
Diplomatic Immunity 

3E Foreign Student 

3F All Others 


TERRORISTS 


4А Known Member of a 
"Terrorist Organization 
Possible Terrorist Member 

or Sympathizer 


4B 


t 
For Further Instructions See: MAOP, Part II, Sections 3-5 thru 3-5.3. 


RACE CODES 

A — Asian/Pacific Islander 
B Black 

I Indian/American 

U Unknown 

W White 


X  Nonindividual 
AGENCY CODES 


AFOIS Air Force Office of Special Investigations 


ACIS Army Criminal Investigative Service 
BATF Bureau of Alcohol, Tobacco & Firearms . 
BIA Bureau of Indian Affairs 

DCAA Defense Contract Audit Agency 

DCIS Defense Criminal Investigative Service 
DEA Drug Enforcement Administration 

DOC Department of Corrections 

DOI Dept. of Interior 

EPA Environmental Protection Agency 

FAA Federal Aviation Administration 

FDA Food and Drug Administration 

HHS Dept. of Health & Human Services 
HUD Dept. of Housing & Urban Development 
INS Immigration and Naturalization Service 
IRS Internal Revenue Service 


NASA Nat'l Aeronautics & Space Admin 
NBIS Narl NARC Border Interdiction 


NCIS Naval Criminal Investigative Service 
RCMP Royal Canadian Mounted Police 
SBA Small Business Administration 


USBP U.S. Border Patrol 
USCG U.S. Coast Guard 

USCS U.S. Customs Service 
USDS U S. Department of State 
USMS U.S Marshals Service 
USPS U.S. Postal Service 
USSS U.S. Secret Service 
USTR U S. Treasury 


LOC Local 
CITY City 
COUN County 
ST State 


OTHR Other 


SUBJECT DESCRIPTION CODES 


UNION MEMBERS А 


5D President 
5E Vice-President 


5F . Treasurer 

5G Secretary/Treasurer 

5H Executive Board Member 
51 Business Agent 

5J Representative 

5K Organizer 

5L Business Manager 


5M Financial Secretary 


SN Recording Secretary 


5Р Office Manager 


5Q Clerk 

5R Shop Steward 

55 Member 

5T Trustee 

50 Other 
GOVERNMENT SUBJECTS 


(6F, 6G, 6H- Include Agency Code) 


6A Presidential Appointee 

6B U.S. Senator/Staff 

6C U.S. Representative/Staff 

6D Federal Judge/Magistrate 

6E Federal Prosccutor 

6F Federal Law Enforcement Officer 
6G Federal Employee - GS 13 & Above 
6H Federal Employee - GS 12 & Below 
6) Governor 

6K Lt. Governor 

6L State Legislator 

6M State Judge/Magistrate 

6N State Prosecutor 


JUDGMENT CODES 


C) Consent Judgment 

CO Court Ordered Settlement 
DF < Default Judgment 

Di Dismissal 

JN Judgment Notwithstanding 
MV Mixed Verdict 

SI Summary Judgment 

VD Verdict for Defendant 

VP Verdict for Plaintiff 


JUDICIAL OUTCOME 


AG Agreement 

BR  Barred/Removed 

CC Civil Contempt 

DC Disciplinary Charges 
FI Fine 

PI Preliminary Injunction 
PR Temporary Restraining Order 
PS Pre-filing Settlement 
RN Restitution 

SP Suspension 

VR Voluntary Resignation 
OT. Other 


DRUG CODES 


COC Cocaine 

HER Heroin 

HSH Hashish 

KAT Khat 

LSD LSD 

MAR Marijuana 

MDM Methylenedioxymethamphetamine 
MET Methamphetamine 


MOR Morphine 

OPM Opium 

OTD Other drugs 

DRUG WEIGHT CODES 
GM Gram(s} 

KG Kilogram(s) 

L Liter(s) 

ML  Milliliter(s) 

P Plant(s) 


DU Dosage Unit(s) 


Continuation of GOVERNMENT SUBJECTS 


6S Local Legislator 
6T Local Judpe/Magistrate 
6U Local Prosecutor 
6V Local Law Enforcement Officer 
6W 6P 
State Law Enforcement Officer 
60 State - All Others 
6R Mayor Local - All Others 
6X County Commissioner 
6Y City Councilman 


BANK EMPLOYEES 


7A Bank Officer 
7B Bank Employee 


OTHERS 


8A All Other Subjects 
8B Company or Corporation 


CHILD PREDATORS 


9A Child Care provider 

9B  Clergy 

9C Athletic Coach 

9D Teacher/Aide 

9E Law Enforcement Personnel 
9F Counselor 


9G Relative 
9H Stranger 
9] Other 


Page Ap 1 09/13/06 13:16:57 
09/13/2006 FIO TNDICTMENT selected 
SENSITIVE / UNCLASSIFIED 
Case Number: 196D-NH-42441 Stat Agent Name: Report Date: 06/09/2006 b6 
Serial No.: 33 Stat Agent SOC.: Accom Date.: 06/06/2006 b7C 


Subject Name 


Assisting Joint Agencies 


Does Accomplishment Involve 


Assisting Agents SOC 


Drugs... 2. 2 2 ee ee ee ФМ E] 

A Fugitive. . 2... . . wee : N 

Bankruptcy Fraud. ......:N 

Computer Fraud/Abuse. . . . . : N RA Squad Task Force 
Corruption of Public officials: N ace iraran Eme. 
Money Laundering. . . . . . . : : N BRA ВЕА1 

Sub. Invest. Asst by Other FOs: b7E 


Investigative Assistance or Technique Used 


FINAN ANALYST LAB DIV EXAMS UCO-GROUP I FT. MON-NRCSC 
AIRCRAFT ASST LAB FIELD SUP UCO-GROUP II FOR LANG ASST 
COMPUTER ASST PEN REGISTERS UCO-OTHER NON FBI LAB EX 


CONSEN MONITR 


PHOTO COVERGE 


NCAVC/VI - CAP 


VICT-WITN COOR 


ELSUR/FISC POLYGRAPH CRIM/NS INTEL IO WANTED FLYR 
ELSUR/III SRCH WAR EXEC CRIS NEG-FED SARS 

ENG FIELD SUP SHOW MONEY CRIS NEG-LOC CART 

ENG TAPE EXAM SOG ASST ERT ASST ASSET FORF PRO 
LEGATS ASST. SWAT TEAM BUTTE-ITC FORF SUPPORT P 
EVIDNCE PURCH TECH AG/EQUIP SAVANNAH-ITC TFOS/CTD 
INFORMANT /CW TEL TOLL RECS POC-WRCSC CXS/CTD 


Indictment is for Federal, Local, or International (F/L/I)...: F 


U. S. Code Violation(s) 


Form FD-515a Side 2: Title Section Counts 
subject's Roles — —et----  ------- 000 -.----. 
18 371 1 
18 2314 3 
18 2 3 


Subject’s Criminal Activity: : Business Influenced/Af fected: 
If Other, Specify. . . . : If Other, Specify. . . . . .: 


If NON-LCN Member or Associate (M/A): 
Name of NON-LCN Criminal Group. . . : 


Name of Company Subject Connected with: 


Elected/Appointed Public Official Position: 
If La Cosa Nostra (LCN) Member or Asso (M/A): If Other, Specify. : 
Name of LCN Organized Crime Group (OCG)... . .: 


Position in LCN ООСА............... š 
Name of Union: 


Union Affiliation: 
If Other, Specify: 
Level of Union. . . . : 
If Local, Give Number: 
Position in Union.: 
If Other, Specify: 


ON 09/07/2006, A SUPERSEDING INDICTMENT WAS RETURNED EEES) S 
THE ADDITIONAL CHARGES OF ONE COUNT VIOLATION OF TITLE ТВ, AND 
1342 


SENSITIVE / UNCLASSIFIED 


FD-302 (Rev. 10-6-95) 


Е 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/07/2006 


Norwalk, Connecticut 
06850, telephone number telephonically provided the 


following information: 


In Marc d 22-2 EE] 2; 
provide him with advance from the proceeds of some 
JAKKS/THQ stock sales, whic i 

requested this money because 


[ found the paper work relate purchase. 
The paper work reflected that harged on his 
American Express credit card. paid off the credit card 
in full. wae also charged a delivery fee. 


is going to send the documentation to the 
undersigned agent. 


Investigation on 06/06/2006 а Bridgeport, Connecticut 


mes 196D-NH-42441 "24 Date dictated 06/07/2006 


by sa | r 5. 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Date of transcription 06/27/2006 


date 


security account number (SSAN) b6 
psg Connecti lephone number bic 
cellular telephone was telephonically interviewed. 


After being advised the j i of the interviewing agent and the 
nature of the interview, provided the following information: 


The PB&J employees 
erminated them. 


the pension fund after 


Th nds were held by a pen 
called PENTEC to 1 
account had approximately 
was told that he could not withdraw the funds. 
as the trustee on the account. 


not aware of anyone having a fight with‏ ل ا 
Leser ing the pension funds.‏ [ 


PENTEC. 


Was 


Investigation on 06/21/2006 а Bridgeport, CT (telephonically) 


File # 196D-NH-42441 Date dictated 6/27/2006 


by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Date of transcription 06/19/2006 


момак, Connecticut +$ 


06850, telephone number[ ^ C CL T] sent a package to SAL | bc 


via the United States Postal Service. The package included a 
cover letter, documentation regarding the purchase of | 
and copies of an American Express credit card statement: 


documents were enclosed into an FD-340 envelope and submitted to 
the case file. 


Investigation on 06/19/2006 at Bridgeport, CT 
File # 196D-NH-42441 — 20 Date dictated 06/19/2006 


by SA . TES - 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Date of transcription 10/25/2005 


2005, Assistan i 
AUSA and 
Special Agent ( of the Federa ureau o 


Investigation (FBI) met with and his attorney, 

at the United States Atto ls Office in New Haven, 
Connecticut. During that ucc ынай зс с. the following 
information: 


On Frida 
Attorney (AUSA) 


October 21 


LLC, Norwalk, 06850, 
telephone number works with who is 
a met when sa 
vendor for WORLD WRESTLING ENTERTAINMENT (WWE). After left 
WWE,[ ^ ^ contacted him because had a client who wanted 


some licensing work performed and did not have the expertise 
in the field. | [aia not know that shared commissions 
with Since has pled guilty, two of J2 LICENSING 
LLC'S biggest clients have fired J2 LICENSING. 


ability to determine right 


rom wrong. 


[___]ьенетев that he was deposed, in the civil suit, оп 
seven to ten occasions. On all of these occasions iti 
was videotaped. Duri i ііі 


Investigation оп 10/21/2005 at New Haven, СТ 
File # 196D-NH-42441 - Oy] Date dictated 10/25/2005 


by SA x. 2 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
i i netta ho dicteibitad antcida vanr илаха ат. К 
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During the first fiscal quarter of 19 
were seated S i : 


that time was earning 


я hat he could help him. 
С апа agreed to split the commission that 
received from WWE on licensees that referred to him. 


set the percentage at 50% of the % commission he received 
from licensees ch O o а to him. Prior to this 
arrangement,[  . ]was referring licensees to ut was not 
receiving money for the referrals. [__  ]had sent licensees to 

because he was too busy with the other aspects of his job 
to deal with the licensing aspect of his duties. 


[  ]inherentiy knew that the commission fee splitti 
was wrong and did not tell anyone about his agreement dn 7] 
During their conversations it was implied that they were not going 
to discuss this matter with other individuals. 


Г ]wantea to pay | lin cash but he was 222. 


get the money out of Hong Kong, so had suggested to 


that create a limited liability company for the p of 
being a vehicle to split the commissions. formed 
—— M the sole purpose to funnel money from to 


BELL CONSULTING LLC was created in March of 1998. 


kept one hundred percent (100$) of the 
| commissions from the licensees that he brought to WWE. С аза, 
however, receive money a [e TRAU & LOEVNER license 


transaction. This was a project that [brought to WWE but he 

shared the commission with Otherwise mmission fee 

split occurred on licensee О, hat helped or sent to 
was "beholden" EE and was never 


eholden" to 


| [J was shown a copy of a check issued to him, 
| individually, on January 14, 1998. This check was issued prior to 


| the formation of BELL CONSULTING LLC i irst payment 
received. The check amount was did not view 
this payment as a commission split. This payment from as 


in connection to the sale of some molds between JAKKS PACIFIC and 
PLAYMATE. [  —  ]brought JAKKS PACIFIC and PLAYMATE to WWE and 


[  ]brokered a compromise between the onflicting factions. 
Under the employment agreement between and WWE, LL duas not 


entitled to this money. 
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С] could not recall when Һе received the first payment 
from his commission fee m L аа 
certain that the payment of was part o£ the fifty 
percent fee splitting agreement. 


would send a photo copy of his WWE Commission 
Statement with "tick" marks next to the licensees that 


referred їо | ^ ] would se a check. 
would then request an invoice from did not ask why 


needed the invoices. However, except for one oversight, 
claimed the payoffs on his taxes. [ |Кере а copy of the 
invoices on his home computer because he did not want it on the WWE 
computer network. 


was one of the top ten licensees in the United States. 
brought TRINITY to WWE in 1995 or 1996. expande 
TRINITY licensing into other apparel categories. The T 
to make exclusive t-shirts for WWE was brokered betwe 

and The agreement was reached in office 
at WWE. ett the meeting because wanted to see 
him. Upon his return to the office, the deal had been completed 
and included an additional two percent (2$) commission to 
from TRINITY. BE اا‎ split of the first installment 
of the additional two percent (2$)commission. [ ^ ]aiso 
received his commission from WWE under a revised agreement memo 


that named as the agent. Since significantly 
improved the deal, opined that would have received the 


commission despite the commission fee splitting agreement. 


TRINITY, a t-shirt manufacturer, seller and a 
e 


[  J]J]made it clear to[  ] that the JAKKS PACIFIC 
transaction was going to be included in the commission fee 
splitting arrangem anted his presentation regarding 


JAKKS РАСТЕГ becau iL he was going 
later learned from WWE'S 


to receive. 
that was receiving money from JAKKS PACIFIC. 


С ]aiso received a commission fee split from[ |] 
from transactions involving the following licensees: GAME DAY, a 


licensee that shifted to ADVANCE SPORT CONCEPT, a 
licensee that shifted to ZIPPO, a licensee that 
brought in but then threw over to to finish off, COMIC 


IMAGES, a lic that Ù] exclusively handled, and CHANGES, a 
licensee muc] О mes ionem ` У 
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y 


handled and did not split the commission from the following 
licensees: JAKKS TOYS, TRAU & LOEVNER, RESAN BOOKS and PLAYMATES. 


rel was fired trom нне, [1] 
told L....] that he was being terminated becau he was not able to 
communicate with е-е соак C] 


however, believes that it wa Lure to provide an inflated 
earnings forecast to WWE ссы Тһе 
wanted а higher forecast ап wha as providing because WWE'S 
stock was going public at the Gr БЕРЕЛ forecast was goj 

report he Security and Exchanges Commission (SEC). 

Was int lares when he was fired. Aft is employment with 
WWE ceased, went t at the XFL, a 


subsidiary of WWE, with permission. [ — laiso 
sublet office space from 


or marke In June of 
E terminated its relationship with Eventually, 
threw[ ^ ]out of the office space that he was subletting 


to him. 


сс 


- бу 


Tn 2001, [ ] sold JAKKS stock and gave a check to 
Г] for his share. This was part of commission payment that was 
included in the JAKKS THQ transaction. [  ]also received some 


other checks i rom [__ ]for miscellaneous items, but the 
checks over were unequivocally connected to WWE. 


Before filing his lawsuit against л (22 


that he was not g i satisfactory offer and was thinking o 
suing WWE. After filed the lawsuit, told [| that 


he thought that should take the offer made because he 


never wanted the commission fee splitting arrangement to get back 
to WWE. 


Prior to deposition testimony in the lawsuit 


b3 FGI 
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b3 FGJ 
agreed to do this because he thought that he 
was in so deep that he had to continue. Не also thought that 
[and WWE would settle the case. 
b3 FGI 
С ]settled the lawsuit WWE filed against him on August 
12, 2005 for S2.5 million. 
[ 1] is aware of WWE approving only one commission fee ре. 


splitting arrangement. That arrangement was approved after full 
disclosure and occurred beford J was employed at WWE. 
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[ — ]heará frm Jana others that[ БЕНЕН 
a marketing employee for WWE, had numerous split arrangements wit 


television stations for syndication stations. Although this was 
not approved by ` ا‎ they did not object to it. 


On Wednesday, Мау 17, 2006, AUSA[ ^ — 3 ]and АС] 


met with [__ Jat the Bridgeport Resident Agency (RA) of the FBI and 


continued the interview of puring this interview, 
provided the following information: 


С] originally sought[ [о be an agent to 
represent the WWE in dealings with companies in the toy industry, 
because had a good reputation within the i stry. 
Later, = ` Was the 
exclusive agent for WWE. 


er 1881, drawn on of 

‚ in the amount of and 
dated October 8, 1998. This check was a finder's fee for assisting 
in the sale of some action figure molds from PLAYMATES to JAKKS. 
PLAYMATES had a license with WWE for action figures.  PLAYMATES 
made molds to produce the action figures. However, JAKKS had a 
strong hold on the action figure market, so PLAYMATES decided to 


sell their molds. [was JAKKS agent. аззізгедГ 1 

in brokering a am ES having conversations regarding the 

— L fs PLAYMATES and JAKKS.  JAKKS paid 
received Бег. was suppose to 

L ШЕ لا‎ kept of 

the mone further opined that receiving the 

probably оста of been okay if he had truly received the money for 

assisting i sale of the molds. However, in hindsight it 

appears to that it was a pay off for the JAKKS video game 


deal. Check number 1881 was issued in the approximate time frame 
as the video game deal. 


b6 
b7C 
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Ee 00 created BELL CONSULTING еме] 
to im that his tenure at WWE was coming to an en 


Therefore,[ ]thought that he was going to need to have his own 
Г for his future livelihood. However, during the time period 


that was employed at WWE, all that BELL CONSULTING was used 
for was to funnel money he received from did not 
pay in cash because it would be too har or to get 
the large sums of money. The money was not sent to a foreign bank 
account in[ ] name because was not willing to "play with 
the IRS." 
[ ]was 1999 8 that Һе created 
x for the payment of told [T] to bill STANFULL 
INDUSTRIAL LIMITED. w that had a relationship with 


STANFULL. Hs the invoice and kn ng paid 
by yee шетен гы did not геса11 receiving the wire 
transfer in his account, but was sure that he was aware of it at 


| the time it occurred. 


| did not tell anyone about the commission splitting. 
| Additionally, has no reason to believe that[ ]ever told 


anyone about their agreement while it was ongoing. It was 


intrinsic that they would keep it quiet. Typically, handed 
the commission splitting checks in either his or office 
at the WWE. did not believe that there were any witnesses to 


his receipt of the checks. The only possible people that may have 
seen ive the checks would have been 
They were 
all assistances at WWE. 
License agreements between WWE and a Licensee were 
memorialized in a "Deal Memo." The Deal Memo reflected who was the 


agent, if any, involved in the transaction. None of the Deal Memos 
reflected the commission splitting between[| ^ ]and[ — ] 


TRINITY was one of WWE's "in house" licensee. and 
lL ]agreed that TRINITY would pay directly to an 
additional two percent (2$) of the ; < did not 
to receive half of the ius ercent payments. However, w 
did send one t p eee that[ [then 
realized inae T dose not suppose to receive a portion of the two 
percent (2$), because[ | did not receive any additional payments. 


Although L__] shifted TRINITY to | |. |C] most 


likely would have received the eleven percent (11%) commission 


b7C 
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pursuant to industry standards because of the amount of work he 
performed and the added value to the licen never 
explored commission rate negotiations with 


Depite[ | lbeiiet that the JAKKS/THQ video game deal 
was the best deal, he was conflicted during the license 


negotiations because let him know that he would split his 
eleven (11$) commission. did not do all that he could have 


done in obtaining a video game license. For instance,[ ]aia not 
pursue the second round of negotiations with ACTIVISION. Pursuant 


to the license contract, WWE received stocks from JAKKS (options) 
and THO (warrants). WWE then transferred eleven percent (11$) of 
the stock eL С Мега the stock, that һе agreed to 
split with in his name. 


[ | did not pursue other opportunities for the WWE 


үү commission splitting agreement. Additionally 

gave preferential treatment. “here were deals that 

could have made but rather sent the licensee toL] so he could 
get half of the commission generated. took care of all of the 


internal matters relating to the split licenses within the WWE. 


continued to ay L__] under the commission 
splitting agreement б-а m] 

continued to рау С] fifty percent (50%) of the included 
licensees' commissions because he was receiving commission checks 
from the WWE. [ ^ ^ ]would calculate what he owed[ [from the 
commission schedule he received from WWE. 


1—8 making the original invoices for [ |] 
because 


said that his accountant needed an invoice. 
CJ never toid[ | anything further about his conversations 
with his accountant. mils шин 


was employed with WWE, һе provided 
with invoices when he received payments from === 


did not recall sending[ ]invoices after he left WWE, but 


thought the documents would speak for themselves. In the original 


invoices[ ]listed the names of the WWE'S licensees that he was 
receiving a commission split payments from 


In June of 2000, while at a licensing show, [  ]1earned 
he 


of SSAI'S termination from the WWE. Not long after t icensing 
show, ғолаГ  |жһағ SSAI'S termination was worth 
something. occasionally heard thi out the negotiations 
between and WWE. For 2. 


told that he could keep the commissions from e 


employment at WWE was terminated. 


b7C 
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deal. Additionally, an employee of the WWE that was 
negotiating with told as a friend, to take the 
deal that was offered to him. 


In October of 2000,[ ] told 


hat the WWE could 


not come to a rea d suit 
against the WWE. 

At this 
time, no one knew of commission splitting 
agreement and did not think that the commission splitting 


would ever be exposed. 


[| never discussed receiving a portion of the lawsuit 
earnings with ^ A  — ]did not think that he would receive а 
portion of the lawsuit earnings. 


was shown a August 20, 2001 letter that he wrote on 
BELL CONSULTING stationery. The letter listed fifteen (15) WWE 
licensees. [| wanted [J to wii is letter because by 
August 2001, the WWE stopped paying pi payments, 
and in turn, stopped payin 


[  ]was also shown a second letter dated August 20 
2001, which was also written on BELL CONSULTING stationery. Г] 
sxplainpd that the first paragraph of this letter meant that 


satisfied his obligations by having the stocks transferred 
into his name. intent was tor te get the stock, 
sell the stock and split the proceeds. was suppose to receive 
less money from the sale of the stocks because pe going to 
have to pay the taxes on the sale transaction. [never told 

how much JAKKS stock he held or how much he sold. In the 
winter of 2001-2002 салем сары asked for more of the 
stocks to be sold. informed that his attorney, 
С] told him not to liquidate any more stock. 


was shown checks drawn on[ ^  ]personai 
account. The checks numbers were 1846, 1869, 1894, and 1941. 
identified checks numbers 1846, 1869 and 1894 as proceeds from 
Stock sales. Check number 1941 was an advance on a stock sale 
because was "cash poor" 
during this time period, so he aske or the stock sale 
rather than dip into his own bank account. 


- OF 


b3 FGJ 
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| b6 
LA not pay for attorney, L___ PE 
or give money for his attorney. complained about his 
lawyer's fees, but never asked for money to pay his lawyer. 
b3 FGI 


the time of the deposition. 
was conscious 
tell the truth 


reported all the income he received from SSAI and 
except one check, stated that the one check that he 
failed to report to the IRS was an honest mistake. 155% ап 
amended return апа his taxes аге now all ир to date. is 
currently undergoing a audit because of his WWE settlement. 


The individua ic design company, had a 
horrendous dispute with "stiffed" them on 
revenues and their pensions. did not know the whole story. 
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Precedence: ROUTINE Date: 12/04/2006 


To: New Haven 


From: New Haven b6 | 
BRA-1/ Bridgeport RA b7C 
Contact: SA 


Approved By: 


Case ID 4: 196D-NH-42441 (Pending) 


| 
| 
| 
| 
| 
| 
| 
| 
| 
" 


Title: 

WORLD WRESTLING ENTERTAINMENT (WWE) 
Synopsis: Case update. 
Details: Оп November 30, 2006, U.S. District Court Judge Stefan 
Underhill denied[ ^ Motion to Dismiss the 


Indictment. 


This case is scheduled for jury selection on January 
22, 2007 and for the trial to commence on January 23, 2007. 


The undersigned i j osely with AUSA 
and AUSA to prepare for 


the anticipated trial. 
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(Rev. 01-31-2003) 


Precedence: ROUTINE Date: 12/15/2006 
To: New Haven 
b6 
From: New Haven pa 
BRA-1/ Bridgeport RA 
Contact: SA 


Approved By: 
Drafted By: [ e] jid A X. | 
Case ID #: 196D-NH-42441 (Pending) ` 
Title: 

WORLD WRESTLING ENTERTAINMENT - VICTIM 
Synopsis: To reclassify this investigation. 
Details: It is requested that this investigation be reclassified 


to 318A to more accurately reflect the nature of this 
investigation. 


% 


349 505 EC. ыра 


E LEE vtl — 24 


ж 


bs & 
| чн) (FBI) 
b6 


From: [ —— — (NH) (FBI) b7C 
Sent: r 18, 2006 12:46 PM 

To: NH) (ЕВ!) 

Subject: F 196D-NH-42441) 

UNCLASSIFIED 

NON-RECORD 

See below: 

SSA 


Bridgeport Resident Agency, 
ivision 


From: [ — ао) (8) 


Sent: 006 12:37 PM 
To: (NH) (FBI) 
Subject: 6D-NH-42441) 


UNCLASSIFIED 
NON-RECORD 


ECU concurs. Looks like this is self-dealing by corporate insiders, and the appropriate classification would be a 318A - 
DP. 


----- Original Message----- 
From! D мн) (Fen 


Sent: i 006 8:42 AM 
To: (CID) (FBI) 

Ca (FBI) 

Subject: FW: 196D-NH-42441) 
UNCLASSIFIED 

NON-RECORD 


E] 


To more accurately reflect the nature of this matter, we'd like to convert it to a 318A. We've got a potential trial on the 
way, and we want to accurately burn the priority classification. If you concur, please respond in an email that we can 
send to the file. 


Thanks! 


55. 
Bridgeport Resident Agency, 
vision 


From: NH) (FBI) 
Sent: Friday, December 15, 2006 8:39 AM 


— rad 


UNCLASSIFIED 


UNCLASSIFIED 


$ e Ф 


То: Ў (FBI) 


( 
Subject: [CS  ]96D-NH-42441) 


UNCLASSIFIED 
NON-RECORD 


1 am preparing this case | inherited for trial and | realized it is а 1960. | think it would be better asa 318A. The b6 


facts are: a former licensing agent for World Wrestling Entertainment (WWE), b7C 
for WWE, were involved in a commission kick back scheme. Pursua tract 
he was entitled to 11% commission of the royalities on all license contracts that he facilitated. n 


orward potential licensees td instead of handling them within WWE per company 
ould then provid 096 of 1196 commission on the contracts that were forwarded to him. 


: plit approximately $1.8 е сс ыш both terminated for азаа 
scheme was discovered during ым suit agains . During the depositions, both ied. 
[ — Дреа guilty in early 2005. 


Based on these facts, do you think it should be changed to a 318A? 


[ | 


UNCLASSIFIED 


UNCLASSIFIED 
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Date of transcription 01/05/2007 


date of birth (dob) 
interviewed at the Federal Bureau of rd === = s (FBI) 


Bridgeport, Connecticut Resident Agency 
Assi ttorney (AUÚSA) 
AUSA During Be interview, provided me 


foll 


October 8, 1998 was a of a brokerage commission.  PLAYMATES, 
a toy company, sought assistance in brokering a deal with 
JAKKS over some toy molds.  PLAYMATES was unwilling to speak to 


JAKKS directly. [ ]thought it made sense to have assist 
because both companies were located in China. received a 
commission for their brokerage and in turn he issued check 


1881 as a portion of the commission. 


The WORLD WRESTLING ENTERTAINMENT (WWE) was not entitled 
to any of this money. However the molds were of WWE characters. 


Investigation on 01/04/2007 а Bridgeport, CT 


File # 318A-NH-42441 Date dictated 01//05/2007 


This document contains neither recommendations nor conclusions of the FBI. 
it and its contents are not to be distributed outside your agency. 


It is the property of the FBI and is loaned to your agency; 


FD-302 (Rev. 10-6-95) 


ЗЕ 


FEDERAL BUREAU ОЕ INVESTIGATION 


Date of transcription 01/09/2007 


met with 


attorney, 


Assistant Unite ates orney 


nd Special Agent (SA) at the 
United States Emm Office in Bridgeport, Connecticut. During 


that meeting, rovided copies of records with respect to 
hea . e records were placed into an FD-340 envelope. 


Investigation on 01/08/2007 а Bridgeport, CT 


File # 318A-NH-42441 -42. Date dictated 01/09/2007 


by SA 


Ы ` 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FD-515 (Rev. 10-1-06) Accomplishment Report e 
Squad supervisor approval (Accomplishment must be reported and loaded into 
(please initial) ISRAA within 30 days from date of accomplishment) 


Date Prepared _! / 12/ 2007 
Date Loaded _ {2} 1 
Date Loader's Initials 


Investigative Assistance or Technique Used 


File Number 1. Used, but did not help 


2. Helped, minimally 


2 
6, e 


D 
n 
Bankruptcy Fraud = AT Rate FO IAT 


Computer Fraud/Abuse Û 
Corruption of Public Officiat O 
Money Laundering . 

Sub Invest Asst by FO(s) D 


Aircraft Asst. 


Asst. FO(s) 
A. 


. D. 


Assisting Agencies X € 
| 


J, 


F. Conviction 
[Feder [Local (I. International 
Conviction Date: 1 / ТӘ, 


Subject Description Code BA . 


For 6F, G, H-Include Agency Code 
Dd Felony or [Г] Misdemeanor 
[A Plea or О Trial 


State: CT Judicial District: С. 


G. U.S. Code Violation 
Required for sections A, B, F and J 
(Federal Only) 
Title . Section 3t Counts 


QUI. BL. 3135. 


A. Complaint / Information/ Indictment 
[Г] Federal Ll1Loca! (О Internationa! 
Complaint Date: 


Check if Civil Rico Complaint [J 


Information Date: 


Indictment Date: 


B. Locate / Arrest K. 


TS (Federal  []Loca! [international 
- - 
. _ Subject Priority: ПА OB [ПС 


| "Locate Date: 


, Arrest Date: 
0 Subject Resisted Arrest 
О Subject Arrested was Armed 


L. 


“2, б. Summons Date: 
[O Federal О Local 
D. Recovery / Restitution / PELP X 
[Г] Federal O Local (О International 


Recovery Date: 
Code * v Amount $ 


Сов” / Amount $ 


Restitution Date: - 
[J Court Ordered [`] Pretrial Diversion 


H. Sentence Date: 
M. 


Sentence Type: 


In Jail: Years. Months. 


Suspended: Years Months. N. 


Years Months... 


$ 


Probation: 


Fines: 


Сою  ,/ Amount $ 
PELP Date: 
_ Code * v Amount $ 1. Disruption/Dismantlement: v 


E. Hostages(s) Released Date: О. 


Disruption Date: 


` Released by: [7] Terrorist (J Other 
i Dismantlement Date: 


Number of Hostages: | 
2 Completion of FD-515a Side 2 Mandatory 


P. Subject Information - Required for all blocks excluding block D (Recovery/PELP), blocks E, |, Land N 


s‏ ا o ER‏ |[ ا 


‘For Indictmenis/Convictiens оў: 


ПП Subject related to an 2 
Complete FD-515a, Side 1 Blocks A-E mandatory, F-H as appropnala. 
Subject related 15'8л OC/Drug organization, a VCMO Program National Gang Strategy targel group, or a VCMO Program National Prionly Inirative target group = 


Complete FD-515a, Side 1 Blocks A-C only. 


x Addilional information may be added by attaching another form or a plain sheet of paper for additional entries. 
е See codes on reverse side. 


D sese weren! 
NITE 
|_ | 
| 
| 


. Asian Organized Crime (AOC), Italian Organized Cnme ШОС), Russian/Eastern European, Canbbean, or Nigerian Organized Crime Group - 


3. Helped, substantially 
4. Absolutely essential 


For Sub. Invest. Assist. by other FO(s) indicate A, B, C, D for corresponding FO 


Rate FO IAT Rate FO 


merg ea __ E 
[rio сов | 
| 
| 
| 


FO 


2 Tech. Ag/Equip. f 
Phone Toll Rec 
BLI | |uco- Group! 


Civil Rico Matters Date: 
Also complete "Section G” 


Other Civil Matters Date: ______ 


Judgment — —— —— —° 


Judicial Outcome, ___%х 
Amount $ 
Suspension: Years Months. — 


Administrative Sanction Date: 
Subject Description Code 


Type: Length: 

П Suspension [1 Permanent 

L] Debarment or 

LJ injunction Year Months 


Asset Seizure Date: 
Asset Forfeiture Date: 
CATS # Mandatory 
Circle below one of the three asset forfeiture: 
Admin, Civil Judicial, or Criminal 


Do not indicate $ value in Section D 


Acquittal/ Dismissal/ Pretrial Division 


(Circle one) Date: 


Drug Seizures v Date: 


Drug Code 
Weight... Code M 

FDN 
Do not indicate $ in Section D 


Child Victim Information 


Child located / identified Date: 


LÀ Living [Г] Deceased 


Social Security No. (if available) 


Serial No. of FD-515 


v Requires that an explanation be attached and loaded into ISRAA for recovery over $1 m and PELP over $5 m, disruption, dismantlement, and drug seizures. 
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Case Number: 318A-NH-42441 


Serial No.: „2 


01/16/07 11:38:36 


kkkkkkkkkkkkkkk CONVICTION Жек 
SENSITIVE / UNCLASSIFIED 


Stat Agent Name: 
Stat Agent SOC.: 


Report Date: 01/16/2007 


Does Accomplishment Involve 


DRUGS Se ep testes жы а ЖЫМ 
A Fugitive. ........:М 
Bankruptcy Fraud. . . . . . . : N 
Computer Fraud/Abuse. . . . . : N 


Corruption of Public officials: N 


Money Laundering 


Sub. 


Invest. Asst by Other FOs: 


Accom Date.: 01/12/2007 bé 
Assisting Joint Agencies Assisting Agents SOC Subject Name БТЕ 
КА Squad Task Force 
BRA BRA1 
b7E 


Investigative Assistance or Technique Used 


INAN ANALYST 
IRCRAFT ASST 
OMPUTER ASST 
ONSEN MONITR 
LSUR/FISC 
LSUR/III 

NG FIELD SUP 
NG TAPE EXAM 
EGATS ASST. 
VIDNCE PURCH 
NFORMANT/CW 
AB DIV EXAMS 


Date of Conviction (MM/DD/YYYY) 


Subject Descript 


Federal, Local, 


Felony or Misdemeanor (F/M) 


Plea or Trial (P/T) 


AB FIELD SUP 
EN REGISTERS 


CO - NAT BACK 
NCAVC/VI -CAP 


ICT-WITN COOR 
IO WANTED FLYR 


НОТО COVERGE CRIM/NS INTEL SARS 
OLYGRAPH CRIS NEG-FED CART 
RCH WAR EXEC CRIS NEG-LOC SSET FORF PRO 
HOW MONEY ERT ASST FORF SUPPORT P 
Об ASST BUTTE-ITC FOS/CTD 
WAT TEAM SAVANNAH-ITC CXS/CTD 
ECH AG/EQUIP POC-WRCSC INFRAGARD/CYD 
EL TOLL RECS FT. MON-NRCSC FC/CID 
CO-GROUP I FOR LANG ASST 
CO-GROUP II NON FBI LAB EX 
SUA supere. ҰЛУЫ Шы : 01/12/2007 
VON: Code, 213202 0h vol шок ж жле жш шо OBA 
or International (F/L/I) .........:Е 
eo заз ы Vales A D тыға kal St Сш Қ 
ue ез геле deny wiles CE, ter V S дат р SR ee e SL. 
Judicial State. 2255-84“ 5а өсе аа ы oy ОТ 
ісі і і Miu 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


To: 


From: 


New Haven 


New Haven 
BRA-1/ Bridg 
Contact: SA 


Drafted By: |[ Jjl 


Case 


ID 4: 318A-NH-42441 (Pending) 


Title: [_____d; dba 


BELL CONSULTING, 
BELL LICENSING; 


WORLD WRESTLING ENTERTAINMENT, INC 


Synopsis: [J pled guilty. 


Details: On January 12, 2007, 


U.S. 


Connecticut. 


District Court Judge Stefan R. Underh 


one count of Title 18 U.S.C. section 371, 
money obtained by fraud in interstate commerce and wire fraud by 
engaging in a scheme to defraud WWE of money, property and honest 
services. [ |ів scheduled April 12, 


[ _ ]is described as follows: 


Descriptive Data: 


%% 


Main Subject 
Name - 


Date: 01/12/2007 


(SSAI); 
(WWE)- VICTIM 


appeared before 
ill in Bridgeport, 


entered a change of plea and pled guilty to 


conspiracy to transport 


2007. 


Last: 
First: 
Race: 


Sex: M 


DOB: 
SOC: 


T deive; 091008. EC. wed 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/25/2005 


was interviewed at the 
United States Attorney's Office in New Haven, Connecticut. 
was represented by his attorney LLL LL plead guilty 
to mail fraud in February related to his fraud scheme at World 


Wrestling Entertainment (WWE). Also present were Securities and 
Exchange Commission attorneys ааа Jand 
AUSA provided the following 


information: 


stated that does not remember his mothers funeral. 

that reviewing documents helped him reconstruct his memory. 
has provided documents on his medical condition to the United 
States Probation Office. 


described his prior work schedule for WWE as 6 1/2 
days per week from 7 am to 7 pm with 2 hours of phone calls at 
night. Over the years at wwE,| | worked on live events, catalog 
sales, pay preview, syndications, and licensing. 


was offered an action figure deal by |] 
in 1995. later became a worldwide licensing agent for WWE. 
department was cut down tol J] a secretary, and in 
September of 1996.[ | saw [C |опе or two times per week on 
average. [_ ]spent two to three weeks each fall in Hong Kong 
visiting toy manufactures. [ ]aiso traveled to Hong Kong for 
two to three weeks after the annual toy fair. 


[| met ا‎ of Jakks at a licensing show in 
June o t the Hilton Hotel in New York City. lL J] 
D contact at Jakks. recalled discussions on 
steel molds, copper molds, manufacturing efficiencies, etc.. 


was the "idea guy" and[ ]was the "go to guy." 
was involved with video games at THO and was "booted out". 


Investigation on 03/25/2005 at New Haven 
SBA I 
File # 396B-NH-42441 J Date dictated 


by 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Continuation of FD-302 of | | ‚Оп 03/25/2005 ,Pge 2 . 


The February 1997 toy fair in New York was the first time 
that heard that Jakks was interested in producinq video games. 
[ шү at the event in New York. mamas ا اا‎ ТІР to 
discuss video game licensing with Jakks. The initial response to a 


video deal was not favorable. The licensing for Acclaim was coming 
up for expiration. [ ^ ]of Leisure Concepts, Inc. was the 


nal licensing agent and received % о мау to дек 
шшш: legally. [s the for Acclaim. 
recalled that WWE received letters on why Acclaim should 


retain the video game licensing.  Jakks planned on obtaining an 
"engine" in Japan and planned on obtaining developers from Acclaim. 


Loo ëE 


[  ]expiained the $80,000 invoice dated January 2, 1998 
as a finders fee for[  ]for helping Jakks acquire a mold for 
figures and having the rights for the product "put in their hands." 
The toy molds were owned by Playmates and were a different size 
than action figures offered by Jakks. Jakks wanted the Playmates 
figures out of the market place. Са sure to approve 
amendments to the transfer rights to Jakks pacific. eta 

to get his part of the job done. Playmates was losing 
icensing agreements and entered into a settlement agreement with 
WWE.  Playmates was not satisfied that they were paid all of their 
royalties. There was no competition in that category. С ]did 
not know why the deal was important to Jakks.  Finders fees vary 
and are based on the company and the quality of the molds. 


received half of the fee. 


Still had that he was collecting 100% on the 
licensing. told that he should have his own company 
,Somewhere else, to receive the fees from 


There were discussions in Januar February and March 
1998 about a Jakks video game deal. p] of THO was 
losing the WWE licensing for video games and wanted to discuss 
i game licensing possibilities with WWE. [сыы telling 
[F hee no one else was biting on the video game license. 
Electronic Arts was going to WWF. [ lwas not aware of the March 
13, 1998 Activision letter at that time. ا‎ | 
responsible for signing any deal memo. On Marc P 8 a deal 


memo with Jakks was signed by When the Activision 
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deal memo surfaced,| | felt that the deal needed to be put in 
front of the McMahons. 


[ recalled having a discussion with _ ] in person 
at the WWE o 


їсе that Jakks would have to put up a new deal to be 
competitive.  Jakks' initial offer was significantly lower than 
Activision's offer and the deals were not comparable on "every 


point". added 10,000 options to the Activision deal for 
himself. had conversations with Jakks to get a new deal. 
The new deal "eaked out" Activision by a small margin. does 
not know why the original deals were so far apart and that bothers 
him. 


Any deals with Acclaim were suppressed as a result of the 
agent scenario with[ ^ ] Jakks was the favored company for the 
video game. Activision had never done a battle game. 


[| generally kept to himself. [was granted 
s 


11$ of the Ja options that were part of the P pee 
roportion to his commission. It was agreed between and 
== that would get half of the commission and shares. 
generally knew wh he amounts were and trusted| ^  ]to 


give him his portion. in hindsight, thought the mold 
payments were related to the video game licence. 


[ ]did not keep a lot of paperwork. [ Даа not 


recall who came up with the descriptions on invoices. would 
photocopy the commission statement апа С] would provide ап 
invoice to j ices at the 25 


Vanzandt (PH 
the invoices at his h 
to "punch them out". 
sometime in 2003. 


worked in the office 


[ | Чоев not геса11 having discussions directly with 
Jakks on the video game deal. 


recalled that treated him differently 


delivered. 


[  ]statea that bragged during the period that 
he could control bragged to the guys at PBJ Design: 


4 
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b6 
at 273 Canal pc 
Street suite 222, Shelton, CT 06484. 


x 


i э. i 
Jio (Rev. 10-6-95) e @ 
4 


ze 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/07/2006 


[ — | interviewed at ited States pê 
Attorney's Tce in New Haven, Connecticut. 1. b7C 
represented by attorne The purpose of the meeting 

was to introduce 
recently assigned this matter and to allow 
opportunity to explain why should not be prosecuted. The 
following information was provided by 


lL  ]expiained the Playmates Jakks deal. 

of Playmates was not getting placement of their licensed 
toys. Playmates wanted to dump + million pieces of inventory plus 
the tooling.  Playmates made miniatures and Jakks had the larger 3" 
to 8" figures. wanted to broker a deal and make everyone 
happy. [-— “leona he was getting a fee for [Eus the 
marriage between Playmates and Jakks. ڪڪ‎ told he would 
let him have half of the finders fee if[ ^ ]would let the transfer 
happen. had no power to bind the contract with WWE. 

cou only bring the contract to the table. The total fee 


was 10% of the deal of $800 thousand for inventory, molds and 
packaging.  Jakk N the deal. There were 
discussions during the Playmates conversations about all of the WWE 
licenses. — — Jakks for the finder fee. The discussions 
may have started in Hong Kong or California. [ ^ |did not 
participate in any due diligence on the deal. 


а that "І never offered anything." 

fe at he was extorted by | lanyt that he 
had earned all of the money from the licensing deals and should not 
had to relinquish 50$ IL assumed [__]was keeping 
the E for himself. a e power to survive жаран |; at 


WWE an had the "right ear of Vince(McMahon)". never 


Investigation on 04/07/2005 at New Haven, Connecticut 


File # 196B-NH-42441 Mio Date dictated 


by SA rcd Keo 
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that he could tell anyone at WWE that he was being extorted by 
for his commissions. 


The video game category was not lL инее. The WWE 
video game license started to be discussed in 1998. WWE was not 


getting royalties from Acclaim. 1а to go find a 
video game licensee by and He was told this at 
a licensing meeting which was held every Thursday. would 


attend if he was іп town which he thought was 70%+ of the time. 


11208669 Activision and met miral 1 
the . It was not sealed bidding апа] was ooking for 
more offers. WWE went with the best offer. WWE ended up with a 
lot of stock in the Jakks deal and Jakks offered a better deal. 
ل‎ "no matter who got the license, I am a winner" 

since he 


had brought in both deals. explained some of the 
differences in the pricing on the deals. 


C аа not know what deal Acclaim had and did not 


know that it was MEE did not rec exact date of 
the final deal. E mee being in office on the 
fourth floor. Was Denon his desk and was standing. 
picked u == deal ms S and asked how much he was 
going to діуе to have Î put the deal in. F l ары 
he S prine both saying 50$ at t me time. does 
not reca anything else being said. ышы Керт his[ ^ ]at the 


time but she has "blanked it out." 


[was never bribed by a licensee. 


[has threatened for his share of the money. 
С ]felt that he had to give 50$ of his commissions or he 
would lose his business with WWE. 


ated that WWE was going Bankrupt in 1997. С] 
and of WWE, asked Jakks to help with WWE's payroll. 
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Precedence: ROUTINE Date: 08/16/2004 

To: New Haven Attn: SAC Wolf 

From: New Haven bE 
squad 7 b7C 
Contact: SA 


Approved By: 

REL 

Drafted py: || Frk 
bu 


Case ID #: 196D-NH-42441 (Pending) 


Title: [| dba 
BELL CONSULTING, 
BELL. LICENSING: 


(SSAI); 
WORLD WRESTLING ENTERTAINMENT, INC (WWE) - VICTIM; 
FBW; 


Synopsis: Request for S i nduct polygraph 
examinations of subjects 
= this date with Aus| Дала case 


SA (BRA). 


for WWE, was a salaried employee 
and not entitled to receive commissions for licengi iness he 
generated for WWE. WWE entered an agreement 4 ара 
SSAT, to рау ommissions for business he brought to WWE. 
was not entitled to commissions on licensing business 
by WWE independent of SSAI. 


However, beginni in 1998, dba BELL CONSULTING, 
directed some = ma s imas? qum then split his 


commissions with j in the form of kickbacks. They also 
created phony invoices to support their scheme. As a result, WWE 
paid approximatel 1.5 million in unnecessary commissions. 

While ТН леш. admitted criminal wrongdoing іп 
their scheme, they differ in their versions of who did what 
regarding the commissions splits and bogus invoices. Both have 
taken polygraph examinations by private examiners regarding 


certain limited aspects of their stories and submitted the 
results to the prosecutor. 


C; wor eg ae | 
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o Ф 
New Haven From: New Haven 
Re: 196D-NH-42441, 08/16/2004 


ausa| ^ — ]has requested they both submit to FBI 
polygraph examinations in this matter, especially regarding 
issues which were not tested during their respective private 
polygraph examinations. 
b6 


olygraph is scheduled for 08/17/2004 at the 972 
New Haven ice; polygraph has not yet been scheduled. 


SAC authority to conduct the above-described polygraph 
examinations otl. аара hereby requested. 


New Haven From: New Haven 
Re: 196D-NH-42441, 08/16/2004 


LEAD(s): 
Set Lead 1: (Action) 
NEW HAVEN 


AT NEW HAVEN, CONNECTICUT 


Upon SAC approval, will conduct polygraph examinatior,;, 
of subjects) fand fas Scheduled. BIC 
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Wednesday, Мау 2, 2007 


Judge pins 2 іп WWE kickback scheme 


By MICHAEL P. MAYKO 


, mmayko@ctpost.com 


BRIDGEPORT — The story line 
is no different than many played 
out on the World Wrestling Enter- 
tainment's television shows. 

There's the loyal employee of 
Vincent K. McMahon Jr. who goes 
bad scheming against his employ- 
er only to see the error of his ways 
and turn his life around. 

That script could have been 
written for James K. Bell, 52, of 
Silver Creek Lane, Norwalk. 

Bell, a former WWE senior vice 
president of licensing and mer- 
chandising, was part of a kick- 
back scheme that cost the 


Stamford-based wrestling enter- 
tainment organization more than 


$100 million in licensing revenue. 

But Bell came clean, admitting 
his guilt, paying back the company 
and turning in his conspirator, 
Stanley Shenker, 62, formerly of 
Smith Ridge Road, New Canaan, 
and currently living in Royal Palm 
Beach, Fla. 

But on Tuesday US. District 
Judge Stefan R. Underhill body 
slammed both men with prison 
terms — eight months for Bell and 
33 months for Shenker. 

Both men are free on bond until 
mid-July awaiting a prison desig- 
nation. Additionally, the judge 
fined Bell $6,000. 

Bell, who pleaded guilty to mail- 
fraud, has made the court-ordered 
$953,302 restitution to the WWE. 

Shenker, who pleaded guilty to 


conspiring to defraud WWE, was or- 
dered to pay $2,867,239 in restitution. 

There is a pending related civil 
suit in Stamford Superior Court. 

Jerry McDevitt, of the law firm 
Kirkpatrick & Lockhart and trial 
counsel for the WWE, said it was 
the “culmination of a long ordeal.” 

“We feel justice was done to- 
day" McDevitt said. 

“This is a scheme that was cal- 
culated with overseas bank ac- 
counts; it's pretty hard to detect. It 
was the perfect storm of events 
that is unlikely to happen again in 
the WWE,” McDevitt said. 

The pair was involved in a con- 
spiracy from 1998 to 2002 in which 
Bell received $953,302 in kickbacks 
for hiring Shenker’s firm, Stanley 
Shenker and Associates Inc., to be- 


come a licensing agent for the 


_Wrestling company. 


In that position, Shenker identi- 
fied potential licensing opportuni- 
ties and negotiated licensing 
agreements, which Bell approved. 

In turn, Shenker received com- 
missions based on a percentage of 
total revenue generated by the li- 
censes he proposed. 

As part of the conspiracy, Bell 
would steer Shenker to companies 
that contacted the WWE 
about licensing deals. He also 
added Shenker’s company to pre- 
existing licensing agreements so 
they could receive a commission. 
That happened even though 
Shenker’s firm had no role in 
procuring those licenses. 

When Shenker received the 


commissions, Bell then sent 
Shenker’s firm a bill for services 
rendered by his Bell Consulting 
LLC. Shenker’s firm then sent Bell 
a check representing his 50 percent 
share of the commissions. 

Shenker deducted those pay- 
ments as business expenses on the 
company’s tax return. 

Additionally Bell and Shenker’s 
firm also received a kickback'from 
a T-shirt manufacturer. The un- 
named company paid Shenker’s 
firm 2 percent of their total sales 
of WWE apparel. The defendants 
split that kickback. 

The case was investigated by 
the FBI and prosecuted by Assis- 
tant U.S. Attorneys Christopher 
Schmeisser and Richard J. 
Schechter. 
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Precedence: ROUTINE Date: 05/11/2007 
To: New Haven 
From: New Haven 


BRA-1/ Bridgeport RA 
Contact: SA 


Approved By: 


Case ID d: 318A-NH-42441 (Pending) 
Title: 


WORLD WRESTLING ENTERTAINMENT (WWE) - VICTIM 


is: istrict Court's judgements o | 
and 


2007, Assistant United States Attorney 
m— Г copies of the United States 
District Court's (Distri icut) Judgement in the 
criminal cases against md The 
copies of the Judgements were placed into an FD- envelope and 


placed in the case file. 
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(Accomplishment must be reported and loaded into 
ISRAA within 30 days from date of accomplishment) 


File Number 
| -2/Йа-л)9-929Ч) | 


Investigative Assistance or Technique Used 
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1. Used, but did not help 
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Code * v Amount $ 
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Restitution Date: / о 3 
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Code • -2l lee Amount su, 87.939 “сс Fines: $ Weight Code 
PELP Date: : EDIN 
[DICEN EPI چ‎ Do not indicate $ in Section D 
Code * v Amount $ 1. Disruption/Dismantlement: v 
E. Hostages(s) Released Date: ou O. Child Victim Information 
Disruption Date: 
Released by: [ ] Terrorist [ ] Other Child located / identified Date: 
Dismantlement Date: 
Number of Hostages: ivi D d 
Completion of FD-515a Side 2 Mandatory C Living E] Decease 
P. Subject Information - Required fof all blocks excluding block D (Recovery/PELP), blocks E, I, L and N 
әд васее | s= | Date of Birth Social Security No. (if available) 
For Indicimenis/Convictiohs only, 4 
Subject related to an LCHfAsian Organized Crime (АОС), Italian Organized Crime (ОС), Russiar/Eastern European, Caribbean, or Nigerian Organized Crime Group - b 
Complete FD-515a, Sigé 1 Blacks A-E mandatory, F-H as appropriate. b 7 С 


LI Subject related to an’OC/Drug organization, a VCMO Program National Gang Strategy largel group, or a VCMO Program National Priority Initiative target group - 


Complete FD-515a, Side 1 Blocks A-C only. 


x Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 


е See codes on reverse side. 


incr v 


¥ Requires that an explanation be attached and loaded into ISRAA for recovery over $1 m and PELP over $5 m, disruption, dismantlement, and drug seizures. 


3164 -it- Yy (| 75] 


| Фф б 05/02/07 10:20:28 | 


| Page 1 
| 05/02/2007 kkkkkkkkkkkk RESTITUTION ХХХ | 
| SENSITIVE / UNCLASSIFIED 
b 6 | 
Case Number: 318A-NH-42441 Stat Agent Name: Report Date: 05/02/2007 b7C 
Serial No.: | Stat Agent MEE Accom Date.: 05/01/2007 | 
Does Accomplishment Involve Assisting Joint Agencies Assisting Agents SOC Subject Name 
A Ешбісіуе.......... IN | | 
Bankruptcy Fraud. ......:N | | 
Computer Fraud/Abuse. . . . . : N | | RA Squad Task Force 
Corruption of Public Officials: N | | -===  ----- ---------- b7E | 
Money Laundering. . . . . . . : N | BRA BRA1 
| 
Sub. Invest. Asst by Other FOs: 
Investigative Assistance or Technique Used 
————— ————————————— | 
INAN ANALYST AB FIELD SUP CO - NAT BACK VICT-WITN COOR 
IRCRAFT ASST EN REGISTERS CAVC/VI-CAP IO WANTED FLYR 
OMPUTER ASST HOTO COVERGE RIM/NS INTEL SARS 
ONSEN MONITR OLYGRAPH RIS NEG-FED CART 
LSUR/FISC RCH WAR EXEC RIS NEG-LOC SSET FORF PRO 
LSUR/III HOW MONEY RT ASST FORF SUPPORT P 
NG FIELD SUP Об ASST UTTE-ITC ITFOS/CTD 
NG TAPE EXAM WAT TEAM AVANNAH-ITC |CXS/CTD | 
EGATS ASST. ECH AG/EQUIP OC-WRCSC INFRAGARD/CYD 
VIDNCE PURCH EL TOLL RECS T. MON-NRCSC FC/CID 
NFORMANT/CW CO-GROUP I OR LANG ASST PPP | 
АВ DIV ЕХАМ5 CO-GROUP II ON FBI LAB EX | 
Restitution is for Federal, Local, or International (F/L/I)...: F 
Restitution Court Ordered or by Pretrial Diversion (C/P)......: C Restitution Property 
==================== 
CODE AMOUNT CODE AMOUNT | 
---- 0 ----------- С eens i 
01 $ 2867239 $ 
02 2867239 


SENSITIVE / UNCLASSIFIED 


Page 1 


05/02/2007 
SENSITIVE / UNCLASSIFIED 


Case Number: 318A-NH~42441 


Serial No.: F( 


Stat Agent Name: 
Stat Agent SOC.: 


Does Accomplishment Involve Assisting Joint Agencies 


Drugs... ee ee ee М | 
A Fugitive. ......... : N | 
Bankruptcy Fraud. . . . . . . : N | 
Computer Fraud/Abuse. . . . . : N | 
Corruption of Public Officials: N | 
Money Laundering. . . . . . . IN 


Sub. Invest. Asst by Other FOs: 


Investigative Assistance or Technique Used 


FINAN ANALYST AB FIELD SUP CO - NAT BACK ICT-WITN COOR 
IRCRAFT ASST EN REGISTERS CAVC/VI-CAP IO WANTED FLYR 
OMPUTER ASST HOTO COVERGE RIM/NS INTEL ARS 
ONSEN MONITR OLYGRAPH RIS NEG-FED ART 
LSUR/FISC RCH WAR EXEC RIS NEG-LOC SSET FORF PRO 
LSUR/III HOW MONEY RT ASST FORF SUPPORT P 
NG FIELD SUP OG ASST UTTE-ITC FOS/CTD 
NG TAPE EXAM WAT TEAM АМАММАН- ITC XS/CTD 
EGATS ASST. ECH AG/EQUIP OC-WRCSC INFRAGARD/CYD 
VIDNCE PURCH EL TOLL RECS FT. MON-NRCSC FC/CID 

INFORMANT/CW CO-GROUP I FOR LANG ASST PP 
AB DIV EXAMS CO-GROUP II ON FBI LAB EX 


Type of Sentence . . . : JS PB 
Date of Sentencing . ..: 05/01/2007 
Federal, Local, or International (F/L/I): F 


Year Month 
Time in Jail. .: 2 9 


Time Suspended. : 
Probation Time.: 3 


Total Fines. . :$ 


SENSITIVE / UNCLASSIFIED 


Assisting Agents SOC 


05/02/07 10:21:01 


کا با تار یاو یکو یاو ہاو یار یاج ا یار یکو یا یاو یکو یکو deesekeseseieesedeicieieiek SENTENCING‏ 


Report Date: 05/02/2007 
Accom Date.: 05/01/2007 


Subject Name 


RA squad Task Force 


BRA BRA1 


F515 (Rev. 12-19-06) 


Drugs 

A Fugitive 

Bankruptcy Fraud 

Computer Fraud/Abuse 
Corruption of Public Official. ГГ 
Money Laundering 
SubInvestAsstbyFO(s) O 


Asst. FO(s) m 


Accomplishment involves: 
(check all that apply) 


Assisting Agencies X e 


Squad supervisor approval 
(please initial) 


A. B. 


A. Complaint / Information/ Indictment 


C] Federat C] Local 


Complaint Date: 


[Г] International 


Check if Civil Rico Complaint o 
Information Date: 
Indictment Date: 

. Locate / Arrest 
О Federal E] Local 
Subject Priority: [JA (18 
Locate Date: 


ÛÎ International 


Пс 


Arrest Date: 
C] Subject Resisted Arrest 
П Subject Arrested was Armed 


. Summons Date: 
O Federal О Local 


. Recovery / Restitution / PELP X 
[Federal 


Recovery Date: 
Code ° v Amount $ 

Code ° v Amount $ 
Restitution Date: Ol /2o6” 

court Ordered — [ ] Pretrial Diversion 
Code* CV y Amount $ : 
PELP Date: 
Code * v Amount $ 

‚ Hostages(s) Released Date: 
Released by: Г] Terrorist [ ] Other 


Number of Hostages: 


P. Subject Information - Required fop/áll blocks excluding block D (Recovery/PELP), blocks E, I, L and N 


File Number 


Loca [O Intemational / 


24700 


Accomplishment Report 


(Accomplishment must be reported and loaded into 
ISRAA within 30 days from date of accomplishment) 


Date Prepared 5/1/200 7 
Date Loaded PF. -2R -ÔT 
Date Loader's Initials (45, 


Investigative Assistance ог Technique Used 


1. Used, but did not help 


2, Helped, minimally 
For Sub. Invest. Assist. by other FO(s) indicate A, B, C, D for corresponding FO 


Rate FO IAT 


Computer 
ШЕСТІПІЯ 
Готе 
ШЕГЕТТІЛІ 
|_| Evid. Purchase 
mewe | 


F. Conviction 
[Г] Federal [J Local 


Conviction Date: 


П International 


Subject Description Code 


For 6F, G, H-Include Agency Code 
O Felony or 


O Plea or 
State: 


[Г] Misdemeanor 


П Trial 
Judicial District: 


G. U.S. Code Violation 
Required for sections A, B, F and J 
(Federal Only) 


Title Section 


Rate FO 


ШЕТТЕН 
soonest | 


. (———)*° 


# Counts 


H. Sentence Date:__O! Y бі [2007 


Sentence Type J S _ IB, 


In Jail: Years. 


Suspended: Years. Months. 


Probation: 


Fines: 


1. Disruption/Dismantlement: v 


Disruption Date: 
Dismantlement Date: 


Completion of FD-515a Side 2 Mandatory 


Months% _ 


Years D Months. 


IAT 


3. Helped, substantially 
4. Absolutely essential 


IAT 


МСАУС/ М-САҢ 
[mn 
— [| 


Non FBI Lab EX 


J. Civil Rico Matters Date: 
Also complete "Section G" 


Other Civil Matters Date: 
Judgment u uw mu ® 

Judicial Outcome, — OX 
Amount $ 


Suspension: Years Months —— 


K. Administrative Sanction Date: 
Subject Description Code 
Type: Length: 
[C] Suspension (О Permanent 


|_| Debarment or 


L Injunction Year Months 


L. Asset Seizure Date: 
Asset Forfeiture Date: 
CATS # Mandatory _ 
Circle below one of the three asset forfeiture: 


Admin, Civil Judicial, or Criminal 
Do not indicate $ value in Section D 


M. Acquittal/ Dismissal/ Pretrial Diversion 


(Circle one) Date: 


N. Drug Seizures У Date: 


Drug Code * 
Weight 
FDIN 

Do not indicate $ in Section D 


Code ° 


O. Child Victim Information 
Child located / identified Date: 


O Living П Deceased 


| Name [ васее [ s= | Date of Birth Social Security No. (if available) 


For Indictments/Convictions only. 


Г] Subject related to ап LCN, As 
Complete FD-515a, Side 


ап Organized Crime (АОС), Italian Organized Crime (ОС), Russian/Eastem European, Canbbean, or Nigerian Organized Crime Group - 
Blocks A-E mandatory, F-H as appropnate, 


Û Subject related to an OG/Drug organization, a VCMO Program National Gang Strategy targel group, or a VCMO Program National Priority Initiative target group = 


Complete FD-515a, Side 1 Blocks A-G only. 


x Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 
e See codes on reverse side. 
Y Requires that an explanation be attached and loaded into ISRAA for recovery over $1 m and PELP over $5 m, disruption, dismantlement, and drug seizures. 


Serial No. of FD-515 
О т 


Зр - (2 y v/ —.89- 


b6 
b7 
b71 


© 


Із 


Page 1 


8 | 8 


05/02/07 10:14:17 


05/02/2007 хк RESTITUTION KK le lee ole ole le olek e e 
SENSITIVE / UNCLASSIFIED 


Case Number: 318A-NH-42441 Stat Agent a | 
Serial No.: 59. Stat Agent SOC.: 


be 

Does Accomplishment Involve Assisting Joint Agencies Assisting Agents SOC Subject Name bic 
A Fugitive. .........:N | | 
Bankruptcy Fraud. . . . . . . : N | | 
Computer Fraud/Abuse. . . . . : М | | ВА Squad Task Force 
Corruption of Public Officials: N | | ---- ----- ---------- 
Money Laundering. . . . . . . : М | BRA BRA1 ТЕ 
Sub. Invest. Asst by Other FOs: 

Investigative Assistance or Technique Used 

INAN ANALYST AB FIELD SUP CO - NAT BACK ICT-MITN COOR 

IRCRAFT ASST EN REGISTERS CAVC/VI- CAP O WANTED FLYR 

OMPUTER ASST HOTO COVERGE RIM/NS INTEL ARS 

ONSEN MONITR OLYGRAPH RIS NEG-FED ART 

LSUR/FISC RCH WAR EXEC RIS NEG-LOC SSET FORF PRO 

LSUR/III HOW MONEY RT ASST ORF SUPPORT P 

NG FIELD SUP OG ASST UTTE-ITC FOS/CTD 

NG TAPE EXAM WAT TEAM AVANNAH- ІТС XS/CTD 

EGATS ASST. ECH AG/EQUIP OC-WRCSC NFRAGARD/CYD 

VIDNCE PURCH EL TOLL RECS T. MON-NRCSC FC/CID 

NFORMANT/CW CO-GROUP I OR "LANG ASST PP 

AB DIV EXAMS CO-GROUP II ON FBI LAB EX 
Restitution is for Federal, Local, or International (F/L/I)...: F 
Restitution Court Ordered or by Pretrial Diversion (C/P)......: C Restitution Property 

CODE AMOUNT CODE AMOUNT 
01 $ 953302 $ 


SENSITIVE / UNCLASSIFIED 


Report Date: 05/02/2007 
Accom Date.: 05/01/2007 


Page 1 05/02/07 10:17:53 
05/02/2007 ЗСА SENTENCING Kee tevle sleeve keke ke ke 
SENSITIVE / UNCLASSIFIED 
Case Number: 318A-NH-42441 Stat Agent Name: Report Date: 05/02/2007 
Serial No.: S 9. Stat Agent SOC.: Accom Date.: 05/01/2007 
b6 
Does Accomplishment Involve Assisting Joint Agencies Assisting Agents SOC Subject Name b7C 
222. 7 | | F | 
A Fugitive. ......... : М | | 
Bankruptcy Fraud... . . . . : N | | 
Computer Fraud/Abuse. . . . . : N | | RA Squad Task Force 
Corruption of Public Officials: N | | soles Сал. RS 
Money Laundering. . . . . . . IN | BRA BRA1 
Sub. Invest. Asst by Other FOs: b7E 


Investigative Assistance or Technique Used 


INAN ANALYST AB FIELD SUP CO - NAT BACK VICT-WITN СООК 
IRCRAFT ASST EN REGISTERS CAVC/VI -CAP IO WANTED FLYR 
OMPUTER ASST HOTO COVERGE RIM/NS INTEL SARS 

ONSEN MONITR OLYGRAPH RIS NEG-FED CART 

LSUR/FISC RCH WAR EXEC RIS NEG-LOC ASSET FORF PRO 
LSUR/III HOW MONEY RT ASST FORF SUPPORT P 
NG FIELD SUP OG ASST UTTE-ITC TFOS/CTD 

NG TAPE EXAM WAT TEAM АУАММАН-ІТС CXS/CTD 

EGATS ASST. ECH AG/EQUIP OC-WRCSC INFRAGARD/CYD 
VIDNCE PURCH EL TOLL RECS T. MON-NRCSC OFC/CID 
INFORMANT/CW CO-GROUP I OR LANG ASST PPP 

AB DIV EXAMS CO-GROUP II ON FBI LAB EX 


Type of Sentence . . . : JS PB 
Date of Sentencing . ..: 05/01/2007 
Federal, Local, or International (F/L/1): F 


Year Month 
Time in Jail. .: 8 
Time Suspended. : 
Probation Time.: 3 
Total Fines. . :$ 6000 


SENSITIVE / UNCLASSIFIED 


(Rev. 01-31-2003) 2 @ 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 06/04/2007 
To: New Haven Attn: Evidence Technician 
From: New Haven 
BRA-1/ Bridg 
Contact: SA b6 
bic 
Approved By: [NG 
Drafted By: [ — j jt 


Case ID #: 318A-NH-42441 (Pending) -$? 
321A-NH-34057- 1 (Pending) , „уь 


uuu cem ж 
WORLD WRESTLING ENTERTAINIMENT (WWE) - VICTIM 

Synopsis: Request for the return of evidence. 

Details: The subjects of the above mentioned investigation have 

pled guilty and have been sentenced. Thus, there is no longer a 

need to retain the evidence. Therefore, it is requested that 1B5 

be returned to Attorney[ |. Jof Kirkpatrick & Lockhart 


Preston Gates Ellis, LLP, which is located at the Henry W. Oliver 
Building, 535 Smithfield Street, Pittsburgh, PA 15222-2312. 


It is further requested that items 1B b7E 
1B13, which are all derivative items from CART, 
and returned to CART. 


% 


155 JUD Of. EC pa 


SEP NIE A294 - S? 


Ж 


То: Мем Haven From: New Haven 
Re: 196D-NH-42441, 05/04/2006 


LEAD (s): 
Set Lead 1: (Action) 


NEW HAVEN 


AT NEW HAVEN 


deposition 


++ 


@ 1А Envelope % 
Case ID: 318A-NH-42441 
INE 13 1 ORIGINAL NOTES RE INTERVIEW OF] Û [PHONE INTERVIEW) ! 
ш - 14 1 COVER LETTER, DOCUMENTS REGUARDIN PURCHASE 
! ! AND AMEX CREDIT CARD STATEMENT 
IN - 15 1 ORIGINAL NOTES RE INTERVIEW OFC] 1 
! ! 10/21/05 & 5/17/06 
w 16 ! ORIGINAL NOTES RE INTERVEIW OF] 1 
INE 17 ! ORIGINAL NOTES RE INTERVIEW OF ф/25/05 4 
INE 18 ГГ MEDICAL RECORDS —— beh C whan U ка 
IN 19 1 FD192 FOR RETURNED 1Bl - 186, 1B9, 18151 
! 1 TRACKING #'S FOR FEDEX SHIPPMENT 
н 20 1 FD192 FOR RETURNED 1B5S 000777777 
FINO 21 ! FDS97 FOR RETURNED WWE EVIDENCE - PROPERTY | 
INE 22 | FD597 FOR RETURNED COMPUTERY 
IN 23 1 FD 192 FOR RETURNED lBB ЕН 
E 24 ! JUDGEMENT NOTIFICATIONS = = 4 
IN 25 ! FD192 FOR 187, 8, 12613 4 


Disposition 


2$ 


(Title) 
(File No.) 


š > > ———— 
ж 
pr 


) di 
i. 


ME 
irn 
; 


лыуы 
ІШІПТІ 


wey 

Nas, ; Ф [°] 
i 2 
{ 
i 

ot 

ае 76 7 
D 


t 4 осо 
` < ° 
' SE 
| DE 
а `. 
‚ u $ 
` 


FD-340a (Rev. 10-3-77) ° + 


FD-340 (Rev. 4-11-03) 


| Cu. 3 
File Number MIG ] ) 7- NH | 42,2 | 
VN . 
Field Office Acquiring Evidence o Kew Hoven 


Serial # of Originating Document 


TE 


Date Received 


From 
b6 
(Address) b7C 
t (4 
New naan, CT 
(City and State) 

w SA) |j 

То Be Returned [] Yes KL No 

Receipt Given O ves < No 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


Ll Yes be No 
Federal Taxpayer Information (FTT) 


L] ves Гу. No 


Title: 


WWE (viid 
Reference; ______  — _ _ O6 
(Communication Enclosing Material) b7C 


Description: A. Original notes re interview of : 
Prine inter view af | | 


— —.—O1c Lud u з ы uem ТТТ Rd 
Á سما‎ Ұ = ru - ` 


TW diis 


| 


— Towards He end of Ars 5521 I 


D C a 


Pentec, 7 fens jen Fo m раке МОРЕ d 


С) Boor $ Da. 
= K new е PBAT der minted, 


р they Can't mos 
` Lied 
"S No Dee - 4 ои 


POHOD М 4 
File Number __ | lo D- NH- Ы) У“/ 
Field Office Acquiring Evidence New Haven 


r 


Serial # of Originating Document . 
Date Received (2/18 {2006 


бом CT. 


To Be Returned ІП Yes E] No 
Receipt Given Û Yes No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (е) 
Federal Rules of Criminal Procedure 

Ll Yes @. No 
Federal Taxpayer Information (FTD 

Û Yes EL No 
Title: 

Wwe 
Reference: 

(Communication Enclosing Material) 


Description: а. Origifial notes te interviewor ^ 


b6 
b7C 


AN 


SANK ATRIA EEA BETA TARA gH TRH A IH I TH wg SSO So 


June 13, 2006 


special AgentL | 


FBI 
1000 Lafayette Blvd 
Bridgeport, CT 06604 


Dear [ | 


Please find enclosed the comm 
purchased for which | requeste 
an American Express bill in which | charge 


а NR NASA Хехех есе хехехехе х= Sha. DANSA EO 


| hope these documents help you on this issue. 


Regards, 


: Detach this stub before depositing check. 


SALES TAX 


REMARKS: 


APC.EFE Б ü © 1999 Moore North America,.Inc, ` APCDIrL,EFE 


w. x оғы wes cup 


л ——— .— ome 00 -..—..-... 


BELL CONSULTING, LLC 


n-——— À——————— O 


FACSIMILE TRANSMITTAL SHEET s 
TO: FROM: 


TOTAL NO, OF PAGES INCLUDING COVER: 


SENOER'S PHONE — 


П1ивбЕМт Mrorerevrew O PLEASE COMMENT [PLEASE REPLY PLEASE RECYCLE 


S3 
| Ez NORWALK. CT 06855-1713 22 Ve 


Za EEE =‏ ی 


s. 
ERE ; To manage your account, Page 1 of 11 
EXPRÉSS visit us on-line at: 


open.americanexpress.com 


SMALL BUSINESS NETWORIC" or call 800-492-8468 


Corporate Platinum Саға” 


Prepared For Closing Dale 


eh зегі enter unih scan mace L Continued on reverse | > 


pus е perse 
BELL CONSULTING LLC 


Transactions Continued Amount b6 
i 


Continuad on next page 


^ 
Ç E 


[e ка 
AMERICAN 
ee BELL CONSULTING LLG ИШИ b6 

› b7C 


Transactions Continued Amount 


cy 


| 
| : Continued on reverse = 
| 


[L s s ss [Cem 
LLC К 


-41 бу 


8 ا‎ 
AMERICAN] * š 


b6 
Hagen BELL CONSULTING LLC Closing Date pic 
: February 4, 2002 
Transactions Continued Amount 


өзе 


© ل“ 
e‏ 


Continued on reverse [s 


Page 6 of 11, 
BELL CONSULTING LLC . : 


ao 


бу‏ ل“ 
e‏ 


BELL CONSULTING LLC Closing Date 
February 4, 2002 
Transactions Continued | Amount $ 


Continued on reverse МУ 


Page 7 of 11 


“ 


| B Account Number 
3732-747341-42003 Page 8 0111. 
= — LLC . 


| b7C 


00904 RO7N1A2A 00268 


February 4, 2002 


Payments: Payments recéived after 12:00 noon or on weekends or holidays may not be credited until the next business 
day. Payments must be in US Dollars and drawn on a bank located in the US. Unless you are paying by computer 
or by phone, please submit your payment in the enclosed envelope with the payment coupon and the account 
number indicated on the check. Please do not send post-dated checks. They will be deposited upon receipt. If payment 
is made in any other form or at any other location, there may be a delay in processing. H your check is returned 
unpaid by your bank for insufficient funds, we may re-present your check electronically. 
Late Fees: We will assess fees for late payment in accordance with the Cardmember Agreement, as amended. 
To avoid fees for late payment, we must receive your payment for the amount due on this statement, not (ater than the 
closing date of your next statement. ` Й Д AN 
Lost or Stolen Card: If the Card is lost or stolen, telephone us immediately at the number indicated on your paper 
Statement or click on the Customer Service link online. Outside the U.S., call collect or contact the nearest American 
Express Travel Service Office or other local American Express office. P . j | 
In Case of Errors or Questions About Your Bill: 1f you think your bill is wrong, or if you need more information 
about a transaction which appears on your statement, write or call the Customer Service department as indicated on your 
paper statement, or click on the Customer Service link enline. We must hear from you no later than 60 days after we sent 
you the first bill on which the error or problem appeared. 

hat We Need From You When You Have A Billing Inquiry: 1. Your name and account number; 2. The dollar 
amount of the suspected error; 3. Describe the error and explain why you believe there is an error. If you need 
more information, describe the item you are unsure about. While we are investigating the amount in question, you are 
zi obligated to pay the parts of your bill that are not in question. Please retain any receipts pertinent to your 
claim. . 
In Case of Errors or Questions About Your Electronic Transfers: Please contact us by visiting us online at 
open americanexpress com or you can call us at 1-800-IPAY-AXP for Pay By Phone and Pay By Computer issues, 
or 1-800-CASH-NOW for Express Cash and automalic payment issues. You can also write to the Express Cash 
Operations address indicated on your statement. If you think your statement, receipt, or transaction is wrong, 
please contact us as soon as possible. We must hear from you no later than 60 days after we sent you the FIAS 
statement on which the problem or error appeared. : 
When contacting us: 1. Tell us your name and account number; 2. Provide the dollar amount of the suspected error; 
3. Describe the error or the transfer you are unsure of, and explain as clearly as you can why you believe there is an error 
or why you need more information. We will investigate your complaint and correct any error promptly. If we take more than 
10 business days to do this, we will credit your account for the amount you think is in error, so that you will have use of the 
money during the time it takes us to complete our investigation. : $ ; 
Credit Balance: If a credit balance (designated "CR" is shown on this statement, no payment is required. You may make 
charges against the credit balance or request a refund. Requests for refunds should be made in writing to the Refund 
Unit at the Customer Service address indicated on your paper statement, or click onthe Customer Service fink online. 
Creditor: American Express Travel Related Services Company, Inc. ; | 


Page 9 of 11 E. 


C 


Telephone 
Numbers 


To Pay By Phone 
1-800-472-9297 


Customer Service 
1-800-492-8468 
24 Hours, toll free 


Business Flex 
Customer Service 
1-800-403-1288 


Express Cash ` 
1-800-CASH-NOW 


Lost or Stolen Card 
1-800-492-3344 
Int'l Collect: 
623-492-7719 


Hearing Impaired 

TTY: 1-800-221-9950 
9:00 AM to 5PM, E.S.T. 
Fax: 1-800-695-9090 


Addresses 


Customer Service 
P.O. BOX 297804 
Fort Lauderdale 
FI 33329-7804 


Express Cash 
Operations 


' P.O. Box 27084 


Greensboro, NC 27425 


. Payments 


P.O. BOX 1270 
NEWARK NJ 
07101-1270 


š : = , RM | a 
Eu um CONSULTING LLC. ` 


00905 RO7N1A2A 00268 


тоо pu MB Чеш. 
EXPRESS 
s BELL CONSULTING LLC Closing Dale 


CustomExtras" February 4, 2002 


= 


An Easier Way to Pay Your Bill - Pay By Computer! . To Pay By Computer, visit 
With Pay By Computer, you can pay your bill every month with a click срвп-атепсапехргев5. 
of your mouse. With this fee-free service, you decide each month how 


much to withdraw from your enrolled checking account to pay your To Pay By Phone, call 
American Express® Business Card bill -- from the minimum amount (1800.472.9297,. 
due, up to your full balance. It's secure, simple and ready whenever { 


SMALL BUSINESS NETWORK" you are. К (СЕ`102265) 


- Please allow two days for payments to post to your account. The offer is provided only to 
Cardmembers who meet certain criteria, by responding you will disclose to the merchant 
that you meet these criteria. ` 


Run Your Business With American Express PN бшш ооа 
Use your American Express9 Business Card from OPEN: The Small Business Card and view 
Business Network™ to outfit your business with computers and our list of merchants/ 
software, everydav supplies and equipment and business services. service providers at 
Continue to use the Business Card to help Keep your business ореп:атепсапехргевз: 


running smoothly Бу automatically charging your monthly bills such сошашонайсань 


SMALL Business netware 85 Utilities, telecommunications and insurance premiums. Save time, (CE 102266) 
effort and'paperwork when you bill your business to your Business 
Card. ' 


The offer is provided only to. Cardmembers who meet certain criteria, by responding you will 
disclose to the merchant that you meet these criteria. 


А New Partiiership With Dun & Bradstreet! |  VsterWebstea | 
American Express has teamed up with Dun & Bradstreet to bring you Comido les IS. 


an extensive suite of on-line tools that will help you make ` about these great new 
better informed credit decisions, find new customers, monitor your products and services. 
5 ! 1 
ES Editus: competition and even collect from delinquent customers! (CE 102103) 
vss i NES > 
Solutions Visit our Web site at www.americanexpress.com/dnb to learn more 

about these great new products and services. 
Terms and Conditions apply. The offer is provided only to Cardmembers who meet certain 
criteria, by responding you will disclose to the merchant that you meet these criteria. 

Save 5% off FedEx Ground Shipping! . lf your Card is already 

s o @ š 5 linked to your account, 

Now you can save 5% on FedEx? Ground shipments. Plus 10% on all call 1-800-231-8636 to 
FedEx® Express domestic shipments! Your savings are automatic activate your Ground 
when you link your Card to a FedEx account. savings 

F Call 1-800-231-8636 or visit www.fedex.com/everydaysavings to (CE 102263) 

ә open a FedEx account or to link an existing account to your Card. 
Ground 

Savings are off the published rate and cannot be combined with any other offer. Savings 
apply to transportation charges only, not special handling fees, surcharges, and other 
charges, including duties or taxes. The discount applies to FedEx Priority Overnight, 
Standard Overnight, FedEx 2Day, FedEx Express Saver, FedEx 1Day Freight, FedEx 2Day 
Freight, FedEx 3Day Freight and FedEx International Priority. Rates are subject to change 
without notice. Rates are not available to package consolidators. 

6cents a Minute on State-to-State Long Distance! To sign up now just call 


As an American Express? Business Cardmember, you qualify for 6 OTE: 


" cents per minute on state-to-state long distance calls, anytime. And (CE 102264) 
ride the light ` 4 this rate will not increase as long as you аге enrolled іп the Qwest 


program. There is no annual contract and no monthly program fee. 


Qwest | 


Terms and conditions apply. The offer is provided only to Cardmembers who meet certain 
criteria, by responding you will disclose to the merchant that you meet these criteria. 
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consulting LLC 
Vicensin/IP Management 


August 20, 200: 


25 Van Zant Street Suite 8A bic 
East Norwelk, CT 06855 | 


| 


This letter will acknowledge that your obligations noted іп our letter of -- 
agreement dated November 14, 2000 as if pertains ә 1 and 

THQ stock, stock options and or warrants has been satisfied and you are 

released from the agreement dated November 14, 2000. 


Itis noted that the THQ stock has been issued in your name and 
is being processed as outlined in the November 14, 2000 agreement. 


Sincerely yours, 


CONFIDENTIAL 
SSAI 28537 


| [ ] Voic2:203.854.9 203.854.9848 * 25 Van Zant Street, Suite 98, East Norwalk, CT 06855-1713 
25 belilicensing.cont EN S. 


WWE/SSAI 
GJ 15731 


E» 


consulting ПС 
Licensinf/IP Management 


August 20, 2001 


25 Van Zant Street Suite 8А 
East Norwalk, CT 06855 


1 


This letter will acknowledge that your obligations noted іп our letter of 
agreement dated April 20, 2000 as it pertains to 5075 participation on the 
following companies is no longer applicable as specified: 


Bowe Industries Ocean Atlantic 
MZ Berger Game Day Enterprises 
m Trinity Trau & Loevner 
ñ Carolina Mfg. Ralph Marlin 
Advance Sports Concepts Kosma Care 
Alliance Publishing Bev Key 
Toys R US Zippo 
THQ/JAKKS Video games ` 
Sincerely yours, 
SSAI 28536 
ШШ 14121:203.854.9848 * 25 uite 9B, East Norwalk, CT 06855-1713 
E belilicensing.com aol.com 
WWEISSAI 
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ENCLOSED ARE THE COPIES THAT YOU RECENTLY REQUESTED. IF YOU HAVE ANY 
QUESTIONS, PLEASE CALL THE NUMBER LISTED TO SPEAK TO 
UR CUSTOMER SERVICE REPRESENTATIVES.  THANK YOU FOR 


SUBPOENAS 


REQUESTOR NAME SUBPOENAS 
REQUESTOR MAIL 
MAIL TO CODE 


ENCLOSED ARE THE COPIES THAT YOU RECENTL 
QUESTIONS, PLEASE CALL THE NUMBER LISTED 
ONE OF OUR CUSTOMER SERVICE REPRESENTATIVES. 


SUBPOENAS 


THANK YOU FOR 


REQUESTOR NAME SUBPOENAS 
REQUESTOR MAIL 
MAIL TO CODE 


ENCLOSED ARE THE COPIES THAT YOU RECENTLY REQUESTED. IF YOU HAVE ANY 
QUESTIONS, PLEASE CALL THE NUMBER LISTED TO SPEAK TO 
UR CUSTOMER SERVICE REPRESENTATIVES.  THANK YOU FO 
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ENCLOSED ARE THE COPIES THAT YOU RECENTLY UESTED. 
QUESTIONS, PLEASE CALL THE NUMBER LISTED ON 


La CUSTOMER SERVICE REPRESENTATIVES. THANK YOU FO 
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та 


. p, Ер-з49 (Rev. 4-11-03) 


File Number IED - AMI 204 | | 
E "M E 
4 ; ей 
E. Field Office Acquiring Evidence ac Z a ene Ne E See | 
ü 

Wd 
i Serial # of Originating Document : 


E Date Received NER М 7 RM ERR | | 


E c 
E From _ CC 


Be (Name of Contributor/Interviewee) 

3 2 (Address) 

Был ا‎ x و‎ === s= =s 
1 (City апа State) | bë 

д b7C 

F B y 

1 То Ве Returned Û] Yes О No | 

3 Receipt Given [ Yes П No ! 
EF Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) - 
f, Federal Rules of Criminal Procedure : 

1 L] Yes H" No . | | 

1 

1 Federal Taxpayer Information (FTI) 
3 Ll] Yes O No | 


E 
$ Title: 


Н 


Reference: 


5 
1 
E: 
J 
Б: 
S 
LU 
4 
a 


(Communication Enclosing Material) 


f 
E Description: L] Original notes re interview of ` 
À ) 2 | | x | 
3 “7772 Lor ГЕ есес 7 TIOE, IBT 205 


AZ f zoe:‏ سن 


` 


| 


T E — | Dm ЕЗ 


ғ-----------ҺҺ------- 


Title апа Character of Case: 


b6 
BELL CONSULTING b7C 
Date Property Acquired: i rty Acquired: 
12/29/2006 


[CT 06902 


Anticipated Disposition: —— — Case Agent: ` 


Description of Property: Date Entered 
1Б 15 
b3 
Barcode: E04020727 Location: 01/10/2007 


Case Number:  318A-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


<< А a T * 
FD-192 (Rev. 3-04-02) - Pa 9 e I at 1 
== I AN 


FBI EVIDENCE DATA-LOADING FORM 


Separate forms arc mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of ` 


evidence. 

Type of Evidence being submitted: Warning - special handling 
| 4 General Evidence ГІ Firearms L] Body Fluids L1 Other 
` (J Valuable Evidence L] FGJ CI Whole Blood 
| ÛJ Drug Evidence | | О HAZMAT 

L] CART 

Case ID: 


AIgA-NH- 49%1 


Person Acquiring Evidence: 


Source from which evidence acquired: 
[Person's name/job title/company/address 


'ederal Taxpayer Information: 


Ll Yes Р П мо 


Anticipated Disposition: Forfeiture Poterit 


Sealed By: [printed name] printed name] 


Estimated Dollar Value: ТоіаЕ гир Package Weight: 


.. 


b3 


(Of. Жш ыз омо то CADCM a Ы 
This form is to be used as а data-loading form only. ЕСТ is to discard this form when the information contained herein has been entered 


) inta Пан Асаба Data Race 


FD-192 (Rev. 3-04-02) 


FBI EVIDENCE DATA-LOADING FORM 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of 
evidence. 


Type of Evidence being submitted: Warning - special handling 


[Z] General Evidence ГІ Firearms [ ] Body Fluids C Other 
ГІ Valuable Evidence О Ес! CI Whole Blood 

П Drug Evidence 

О CART 


Case ID: 


3g A- NH - 424] 


Person ue Evidence: 


Source from which evidence acquired: 
[Person's name/job title/company/address] 


Title and Character of Case: 


Date Acquired: 


e 


12/29 250€ 


Anticipated Disposition: Forfeiture Potentil z: Federal Taxpayer Information: 


О Yes | О No 
Sealed By: [printed name] printed name] Е 
Estimated Dollar Value: Гір Package Weight: 


- 


L= ъала Z= шш = =Í = F—VhYa 
This form is to be used as a data-loading form only. ECT is to discard this form when the information contained herein has been entered 


inta Guidanra Data Race 


b3 


E. D-1004 FEDERAL BUREAU OF INVESTIGATION 
52222 EVIDENCE CHAIN-OF-CUSTODY 


Evidence Type: “Genera Оргир LlValuable OFirearms OCART 


Special Handling Instructions — — ¬ A fnitial Receipt 
Time 


D Batteries O Biohazard O FGJ == — ٣1 RET 


O HAZMAT [з Latents о Refrigerate 
O Req. Charging О None 
O Other 


Relinquished Custody 


j;‏ ا 


Reason: exo сү 


Signatura 
ER dle 
| z26/7 


Reason: OLA GL 


e and 


| e 
275 
жеме — — rs 
Reason: ж 4 2 Lue сс зс 2-22-20 


Date and | Accepted Custody И. PSI and 


Time 4 | PSI 


Жази о с су у 


Accepted Custody | 


Date and | 
Time 


Accepted Custody ` Date ала. 


| _ | Time 


Printed Name: 


Reason: 


| Date and | Accepted Custody 


Time | КЕ OP E 


Reason: 


Firearms Certification: 
Printed Name: — .  .— .— бірпаёше: Пас. 


Case ID: 3I6A-NH: 424Ut 1B: 19/57 Barcode: CO 1020 7279 


Date and | 
ime 


Relinquished Custody 


EVIDENCE CHAIN-OF-CUSTODY 


Continuation Page 


Relinquished Custody | Date and | — — Accepted HUE | | Date and ` 
| Е Time Time | 


Relinquished Custody Date and ` Accepted — Date and ` 
| | А Timé Tiine 


 Relinquished Custody - ' Date and | аш — Custody | ` Date and 


Na | | | ЖЕ i | | | Time 


 Relinquished Custody 1 Date and | — Custody Date and . 
| Time Time. 


[е sss 


 Relihquished Custody | Date and | Accepted Custody ` Date and | 
Time | | Time : 


Relinquished Custody E Date. Accepted — m Date and ` 


Case ID: 1B: Barcode: 


ы FEDERAL BUREAU OF INVESTIGATION 
2. EVIDENCE CHAIN-OF-CUSTODY 


Evidence Type: ‘Genera O Dru OValuable Firearms — CART 


Date and . 
fme ` 


Кл о 


о == l 
ml Name: | 


аа Collected 


` Special Handling. Instructions 


O Batteries O Biohazard O FGJ 
O HAZMAT D Latents D Refrigerate 
п Req. Charging O None 


Accepted Custody | 1 рабе and : 


| Date aud | Е 
Time J 4Һ5ӛҘҙ5ӛ50ӛо0зҘ9Д5ЗҘЗ | 


Printed Name: Printed Name: 


| к, WE ` Accepted Custody - 


Printed Name: 


Reason: 


| Date ahd | f ` Accepted: Custody | Date and 
Tie | | Time 


— ER 


K... БЕ 


Printed Name: 


. 


| Printed Name: | Name: 


ws 


Date and ` 
Time d 


` Relinquished Custody 


Reason: 


| Date and ` 


== 
Firearms Certification: 


Printed Name: i Signature: Date: 


| Кг Custody 


Reason: 


Case ID: 1В: Barcode: 


`. Ы "om 


| o sv 
| 03/31/03 
| 14:25:27 


[| 


ED21191 Page 


"E NE 


Title and Character of Case: = 


BELL CONSULTING’ 


Date Property Acquired: Source from which Property Acquired: 


03/21/2003 
PITTSBURGH PA 


Anticipated Disposition: noe E Case — 


Description of Property: Date Entered 
1B 1 


Barcode: азе Location: [ 0| 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


Kao-Nl- «491—187 


Case ID 


Accepted By: 
Printed Name 


ЕО es ойға ЕКИ ТТК ТЕСЕ расе/тіпе: S/Z// 03 

Accepted By: 
Printed Name: fee. Signature: Da 
Reason: .. GA зук. Fs Yoy бд 


Accepted Ву: 
Printed Name 


Accepted By: 
Printed Name: .. Signature: 


жм: май: iS Saf was, ssp ш» ай» шк. тан аши is ety was” текте а ТАБ кан ДЬ —————Á———————— ан iw сан WE Чы, ia: a эши “am, Эй: ота aS. amk. ant бй in sa: k=: чын. "n ае бес کی‎ бісе білші ін ад was шк, ей Өй a ¿= жы еді i ш d 


Accepted By: 
Printed Name: . | sd а Signature: : 


03/31/03 ICMIPR01 
14:29:32 FD-192 Page 1 


Title and Character of Case: 


b3 
BELL CONSULTING 


ЕЕЕ EE ee uama 
ATTORNEY 


03/21/2003 
STAMFORD CT 


. Description of Property: | | Date Entered 
1B 2 
Ваксоде: E02119147 Location: 03/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


“ + 


Chain of Custody FD-192 а 
Case Ір . : Barcode 
Accepted By: 
Printed Nam .. Signature: ЖР 
=. 9) 
Reason:..Collected. ZEVI eee Date/Time: x/zilo3 e /Z Yn, Я 


Accepted Ву: 


Printed Мате: .. Signature:. 


Printed Name: L 1... ..... Signature 


Accepted By: 
Printed Name:... Signature: : 


Reason Keton e«t —=. A саву. Date/Time: SELB. . JOPI.. 
"rm Ea 7, 24 р со END 
Accepted By: 

Přinted Name p, асан МЫ Hed qua SIATS iv ыг, жк ce ewes sds ЫЫ Жөн 

RES SOM NOT LET C килы ыл ан КАМЕ ЕКЕ ЫР Date/Time:.................... 


03/31/03 
14:33:16 


l o o ws 


E021131! 


Title and Character of Case: ыз 
3 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


03/21/2003 
STANFORD CT 


Anticipated ор = Case — = 


Description of Property: Date Entered 
1B 3 
Barcode: Е02119148 Location: 03/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


[а ty. AH Ч «85 


Case ID 

Accepted By 
Printed Nem — — |.. signature: | 
Reason:..Collected. p e qa Date/Time: sz, fas. a "m 


Accepted By: 
Printed Name 


Accepted By: 
Printed Name 


Reason 265540. 


Accepted Ву: 
Printed Name:. 


Reason:......... 
Accepted By: 
Printed Name:. . Signature: | pus 
Reason: енеге; wus, boc. биебер. AE ; Date/Time: SZ2Z 2 . 2309... 
Accepted By: 
Printed Name: "EE ЄЛ апак етиш euch cg. wee eee 
RedsOm ык ын OE алк ea p eme RD аны ere NE ie ee RUNE Date Tine? wins need ықы ке, 


accepted By: 
Printed- Names, egede алаан SES RA ера оар REED D 


Accepted By: 
Printed Матеа сика SS y Ы Ie Signatures a кюк кы u siga gus 


Accepted By: 
Printed Мате аал кеки» OP Uy e Signatores$u jes ee з ss АЛЕ Eh ei 


Accepted By: 
Printed Матеа аана аа таза ЖЕ C W AUS Signatures ааа ed Cea шкак КЕЙ 


Беавой іс кк лук Wa eas Bests ahs, Ма ERA s iw DateTime тт нык vs 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Printed Name:.................... ерен U wie кк 55 Mees RA Date:........ 


ЕНЕСІ 


Ш 


ІСМІРЕ01 
FD-192 Page 1 


اد 
Title and Character of Case:‏ 


03/ 
14: 


| 


b3 


BELL CONSULTING 
Date Property Acquired: Source ae cquired: 
03/21/2003 - 


PITTSBURGH РА 
Anticipated Disposition: Acauires Ву: =. m 


Date Entered 


Description of Property: 
1B 4 


Barcode: E02119149 Location: 03/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


p 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 
Жр, UH- >ЧЧНРУ 


Chain of Custody FD-192 


Case ID . : Barcode 
Accepted By: 
Printed Мапе]. signature: 
x "NEM. t A Ӯ / / oS, 
Reason:..Collected. \cvrdence ................. Date/Time: 5/2//05../2..Ф/И.. 


Accepted By: 
Printed Name:| | | | | s eo  [....... Signature 


Accepted By: 

Printed Name S 
б с iu si 

Printed Name:... ... Signature: P 


Reasons QS esa wa quara S ORE Lua ақылы tesa iore Date/Time: 5 с>. ЕЗБЕ аб 
Accepted Ву: 

т. ст. „ШЙ еы. .. 

> em IL = I А LA /25 

Reason: raed. 24277] {бс Уы T A iL. Date/Time: :$£4227072..722 eo. 
эе д ea 855 iMi 
Accepted By: 

Printed маце аен dubie Signature ТТТ Gak аа 

REASON Hy is oh shes ou ue QUEE eb ede Dates TIME ois зы ow xa MP RE 


r Y .. “ы 


m 


Foes L B T 


11:57:25 : FD-192 * Page 1 


Title and Character of .Case: Í i А: 


NSULTING i 
Date Property Acquired: Source ‚шшк Acquired: 


ATTORNEY 
08/15/2003 D 


Anticipated Dispssttisn: pu E E pore) 
Description of Property: Date Entered 


1B 6 


Barcode: Е02119618 | "Location: É 08/27/2003 
Grand Jury Material (Disseminate only pursuant to Rule б(е)) 


P * 


PACKAGE COPY 


à Case Number: 196D-NH-4244] 


Owning Office: NEW HAVEN 


+ Chain o£ Custody FD-192 


Case TD . : Barcode 


Accepted By: 
Printed Name: 


Accepted By: 
Printed Name 
P = 


Accepted By: 
Printed Name: 


E 20 


Accepted Ву: 
Printed Мате: 


44...4....... 274 бе ә Dar) 


Printed Name:..... 
od ~ (See. LMP bev. Auer. Date/Time:. ЕУ э ../24025 || 
BNI SCO Bn tS S ws osa as РА кара окна LN 
Printed Майе хетт сыға RR SIGUE UT кас“, RSE 
Sd, suf тан КЕКЕК Г КОЛГЕ Date/Time ici ексек кұмда EE өл» 
Printed Мате: ор: ва ia та ле a йа Signature raaa aeo ese ӨҚЕ 
mua Sapa CU Ba ну E Л ete cm be раве Раме saa uu ex Ere da 
Printed Names iae ey шшк Ылан А У Su Gia Cure м bese OSes aa RW EA Or asa 
gcc ECCE C MC astern ieee SS RT павеў Тілес ъа ERE Rue 
Printed NAMES ае инеш as EY eoe a Re ae Glendbi eng жуанды он ae 
Jr ШЕЛГЕ АРАСЫ TESORO Date/Time з cao odd кы а ahua lass 
Printed мате u upa ae aa Re NE Ss Өзепанпкесыса знака eia as 
arm Date Timê ius i bone que Dew dedo scd 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Бый ive тр ы rented da Signatures. Ge жже ke wax as Dater.,.. ... 


09/03/04 4 ІСМІРЕ01 
08:50:35 FD-192 Page 1 


Title and Character of Case: 


b3 
BELL CONSULTING 
Date Property Acquired: 
08/23/2004 
Anticipated Disposition: Acquired BY: Case Agent: _ 
Description of Property: Date Entered 


1B 9 


Barcode: E02120996 Location: = f 
Grand Jury Material (Disseminate buy pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


4 ` 


FD-192 (Rev. 3-04-02) 


FBIEVIDENCE DATA-LOADING FORM 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of = 
| evidence. | 


Type of Evidence being submitted: Warning - special handling 
| LJ General Evidence ГІ Firearms L] Body Fluids DX Other 
| ПІ Valuable Evidence pm FGJ ГІ Whole Blood ШЕН 
| ГІ Drug Evidence 


L] CART 1 1 viro. 
Case ID: 
gD VA- Ya b6 
b7C 


Person Acquiring Evidence: 


Source from which evidence acquired: 


Pe on’s name/ioh e amnan Та Га 


Anticipated Disposition: Forfeiture P. Federal Taxpayer Information: 
П Yes gn No 

Sealed By: [printed name] І 1 +yz [printed name] 

Estimated Dollar Value: 


This form is to be used as a data-loading form only. ECT is to discard this form when the information contained herein has been entered 
into Evidence Data Base. 


Chain of Custody FD-192 


Case ID. : 196р- AH - ЧА q l - 1B4 Barcode . : 22120996 
Accepted By: 
Printed Name:. Signature:. à 
Reason:..Collected.€set* ^], SHIA Pe MALA 2j .. Баке/Тіпе:. 2-22-2927,, RISA 
Accepted By: 

Printed Name .. Signature Ке 
Ееавоп:..С:Мё%-..@ХАМС...................... Date/Time: 4125407... Ne d 
Accepted By: DE 
Printed Nam i Signatur | 


........ 


: E43 
Reason: & сс а е ee A А Bly el Ii Na Date/Time: V[$*5. 2...f... A4 өлі 


Accepted Ву: 
Printed Name:[___ — | signature = 


Reason:........... Dra е ee Re қаша аз Date/Time: 5%. СӨ Терен 
Bon rr 

Printed Name: Signatur 

Reason:. fepe. . = wate fer Жебе TSJ... САБИ iNES SHE HEP 
Accepted By: " 

Printed Матеа cedet aee Ұл ае Signature:......... Pals aves бала es ЛЕ С. 

Reason usu ese eects a Dah ae endl ae enr tese b Eun ere Date/Time ааа Cnet eS 


Accepted By: 
Printed Name x eda Iss ed Bonet is Signature? PED 


Accepted By: 
Princea Name:s.oicu зо ка Ша Ы БОЛЫ? бта еа ысытатын ЕЕЕ se 


Accepted By: А 
Printed Маше аатын ао IH Ham элн Signatüre Siok кунк Алын ata ag 


Accepted By: 
Printed Мате зе а + be kee eee зат du vem Бола теж лиш нж вк тт АЖ еш ДАЯ 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Printed. Names u y ere xA ue Лас ету ые м aaa ed Dates wi 


Ма\: 
DV: 


22.9 LBS 


Date: 05/24/2007 


SPECIRL: 


HRNDLING: 


0.00 TOTRL: 


Sves: PRIORITY OVERNIGHT 


Wgt: 
DV: 


30.1 LBS 


Sves: 


TRCK: 7259 3015 7804 
Date: 05/24/2007 


SPECIAL: 


HANDLING: 


0.00 TOTAL: 


PRIORITY OVERNIGHT 


TRCK: 7259 3015 7815 


Mgt: 
DV: 


19.3 LBS 


Date: 05/24/2007 


SPECIRL: 


HANDLING: 


0.00 TOTAL: 


SHIPPING: 


SHIPPING: 


SHIPPING: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7826 _ 


Wgt: 
DV: 


22.1 LBS 


Sves: 
TRCK: 7259 3015 


Wgt: 
DV: 


21.9 LBS 


TRCK: 7259 3015 


Date: 05/24/2007 
Wgt: 14.7 LBS 


DV: 


Date: 05/24/2007 | 


Date: 05/24/2007 


SPECIRL: 
HANDLING: 
0.00 TOTAL: 


PRIORITY OVERNIGHT 


7837 _ 


SHIPPING: 

SPECIRL: 

HRNDLING: 
0.00 TOTAL: 


_ Sves: PRIORITY OVERNIGHT 


j 7848 — 


SHIPPING: 

SPECIAL: 

HANDLING: 
0.00 TOTAL: 


ОСЕ 


| Svcs: PRIORITY OVERNIGHT 
Pe TRCK: 7259 3015 7859 


^ pate: 05/24/2007 
Wgt: 24.3 LBS 


DV: 
Svcs: PRIORITY OVERNIGHT 


SPECIAL: 
HANDLING: 
0.00 TOTAL: 


SHIPPING: | 


TRCK: 7258 3015 7860 


Date: 05/24/2007 
Wgt: 18.6 LBS 


DV: 


SHIPPING: 

SPECIRL: 

HANDLING: 
0.00 TOTAL: 


` Sves: PRIORITY OVERNIGHT 
TRCk: 7258 3015 7870 


Date: 05/24/2007 
Wgt: 26.9 LBS 


DV: 


SHIPPING: 

SPECIRL: 

HANDLING: 
0.00 TOTAL: 


. Svcs: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7881 _ 


Date: 05/24/2007 
Mgt: 17.8 LBS 


DV: 


tef: 
Jep: 


SHIPPING: 

SPECIAL: 

HANDLING: 
0.00 TOTAL: 


Svcs: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7892 


tef: 
Зер: 


tef : 
Jep: 


Date: 05/24/2007 SHIPPING: 

Mgt: 14.8 LBS SPECIAL: 
HANDLING: 

DV: 0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7907 


Date: 05/24/2007 
Wgt: 18.5 LBS 


DV: 


SPECIRL: 


HANDLING: 


@.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7918 


Date: 05/24/2007 SHIPPING: 
Wgt: 23.6 LBS SPECIRL: 

: HANDLING: 
DV: 0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7929 


SHIPPING: 


Date: 05/24/2007 


SHIPPING: 


SPECIAL: 
HANDLING: 
0.00 TOTAL: 


Wgt: 20.8 LBS 
DV: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7930 
Date: 05/24/2007 
Wgt: 25.7 LBS 
DV: 


Svcs: PRIORITY OVERNIGHT 
TRCK: 7259 3015 7940 
Date: 05/24/2007 
Wgt: 22.9 LBS 


DV: 
Sves: PRIORITY OVERNIGHT 


SHIPPING: 

SPECIAL: 

HANDLING: 
0.00 TOTAL: 


SHIPPING: 

SPECIAL: 

HANDLING : 
0.00 TOTAL: 


^, TRCK: 7259 3015 7951 
Date: 05/24/2007 
Mgt: 13.1 LBS 


DV: 


2. TRCK: 7259 3015 796 
Date: 05/24/2007 
Mgt: 26.9 LBS 


SHIPPING: | 


SPECIRL: 


HANDLING: 
0.00 TOTAL: 


Ne PRIORITY OVERNIGHT 


2 2 


SHIPPING: | 


SPECIAL: 
HANDLING: 


DV: 0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
`. TRCK: 7259 3015 7973 


Date: 05/24/2007 
Wgt: 13.3 LBS 


DV: 


SHIPPING: 
SPECIAL: 
HANDLING: 


0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 


.. ... IRCK: 7259 3015 7984 


Date: 05/24/2007 
Wgt: 17.3 LBS 


DV: 0. 
Sves: PRIORITY OVERNI 


SHIPPING: 

SPECIAL: 

HANDLING: 
00 TOTAL: 


GHT 


ROK: 7259 3015 7995 


Date: 05/24/2007 
Wgt: 13.6 LBS 


DV: 


SHIPPING: 

SPECIRL: 

HANDLING: 
0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 


7259 3015 8008 


tef: 
дер: 


ef: 
Зер: 


tef : 
дер: 


EtSUELo c 


Date: 05/24/2007 SHIPPING: 

Wot: 13.7 LBS SPECIAL: 
HANDLING : 

DV: 9.00 TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 8010 


Date: 05/24/2007 SHIPPING: 

Wet: 23.6 LBS SPECIAL; 
HANDLING: 

DV: 0.00 TOTAL: 


Sves: PRIGRITY OVERNIGHT 
TRCK: 7259 3015 8020 


Date: 05/24/2007 SHIPPING: 

Wgt: 25.8 LBS SPECIAL: 
HANDLING: 

DV: @.0@ TOTAL: 


Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 8031 


Date: 05/24/2007 SHIPPING: 
Mgt: 22.1 LBS SPECIRL: 


HANDLING: 
DV: 0.00 TOTAL: 
Sves: PRIORITY OVERNIGHT 
TRCK: 7259 3015 8042 


Date: 05/24/2007 SHIPPING: 
Wat; 0.8 LBS SPECIAL: 


2 HANDLING: 
DV: 0.00 TOTAL: 


Sves: PRIORITY OVERNIGHT ' (94 


TRCK: 7259 3015 8086 ~ 


FD-340 (Rev. 4-11-03) | 
| : (Aa) 
File Number .— 252-240. 


Field Office Acquiring Evidence SIE 


Serial # of Originating Document EE 


Date Received _ 67/2 “о? 


Его 


iewee) 


(City and State) 


ا 
To Be Returned [] Yes Û] No‏ 
Receipt Given [J Yes CI No‏ 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


L] Yes L] No 
Federal Taxpayer Information (FTI) 
[1 Yes О No 


Title: 


Reference: 


(Commiinigation Enclosing Material) 


Description: Q Original notes re interview of 


OS — e tornec Сг, e) 


—————  — зе 


FD-597 (Rev 8-11-94) Page 1 of | 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property Received/Returned/Released/Seized 


File # 318A-NH-42441 


On (date) M. 4d 46o71 item(s) listed below were: 
[] Received From 


ХА Returned То 
[] Released To 
[] Seized 


- ON 


63 


(Name) 


(Street Address) 


(City) Pittsburgh, PA. 15222-2312 


Description of Item(s): _ Total of 25 individual boxes and one envelope containing 


t 


Kirkpatrick & Lockhart Preston Gates Ellis, LLP. 


(Signature) 


| —ri кл M MI I C EDD E. ОНЫН specs dac c озаны DS ы аса ана Quo MM РАКЫ НЕГЫ аса кілі 


U.S. Department of Justice 


Federal Bureau of Investigation дк Pos, US OFFICIAL MAIL 
g Ке 
600 State Street seemed ae 6 Ёё, d сіз E 
New Haven, CT 06511-6505 Vu 2 Ge SEE mc COWES 
Official Business ER fe: 02 1A $ 00 " 4 1 0 


Penalty for Private Use $300 0004202839 


5" MAILED FROM ZIP CODE 06511 


DEN Ж Evidence Technician 

PT FBI - New Haven Division 
600 State Street 

New Haven, CT 0651 


DE А, A a GENS, | Malla йн инни ji ишинин 
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File Number - Jy tt- JAVA #22 


Field Office Acquiring Evidence AU n 


Serial # of Originating Document eaaa aua 


ress 


By _ | mur E 


t 


То Ве Returned C] Yes П No 


Receipt Given [J Yes ÛÎ No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (c) 
Federal Rules of Criminal Procedure 


Ll Yes О No 
Federal Taxpayer Information (ЕТІ) 
Ll ves О No 


Title: 


Reference: 


(Communication Enclosing Material) 


Description: 


ПІ Original notes re interview of b3 


Сес. ect 
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UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property Received/Returned/Released/Seized 


File # 196D-NH-42441 


— 
On (date) Jne 7 46 item(s) listed below were: 
[] Received From 


[] Returned To 
xx Released To 
[] Seized b6 


(Name) 


(Street Address) 


(City) Pittsburgh, PA 15222-2312 


U.S. Department of Justice 


| Federal Bureau of Investigation 


600 State Street 
New Haven, CT 06511-6505 


Official Business 
Penalty for Private Use $300 


Бочац 


FBI New Haven 
ЕуіЗепсе Technician 
600 State Street 

New Haven, Connecticut 


нйн 


POS. 0,5, OFFICIAL MAI 
Nd US OFFICAL MAT. 
G Qe cm 


[Aa 
ASE 


сп 0 GF m 
02 1A $ 00.41? 
~ 0004202839 


ка: MAILED FROM ZIP CODE 06511 


UN 
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File Number {88 -ADXH AAI 2 2: 
. Field Office Acquiring Evidence A. 


Serial £ of Originating Document 


Date Received Shelo EEIE ELLIE e 


From cC 


(Name of Contributor/interviewee) 


(Address) 


City and State) | 
| O š | > 
b7C 
By 1 


ToBeRetumed [Л] Yes ` Û No 


Receipt Given O Yes П No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure | 


[1 Yes О м 
Federal Taxpayer Information (ЕТІ) 
[1 Yes О No 


Title: 


Reference: 


(Communication Enclosing Material) 


Description: [l Original notes re interview of 


— fore. Q- retumedl IBST 


08/27/03 ICMIPRO1 
11:54:37 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source f i y Acquired: 
ATTORNEY 


08/15/2003 


Description of Property: Date Entered 
1B 5 


Barcode: E02119617 Location: ЕСС1 - 08/27/2003 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


0.33 = 
а SHIPPING 0.72 
6/2007 ECIRL: 0.00 = "p 
pate: 06/086 SIND ING: 11.05 > 7 
Ref: ugt: 9: 0.00 TOTAL 
Dep: ру 
IGHT 
sves: Rss 3015 9255 


PACKAGE COPY 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


^ Chain of Custody FD-192 


Case ID . : Barcode 


Accepted By: 
Printed Nam 2242 


Accepted Ву: 
Printed Name: 


Accepted By: 
Printed Name 


Reason: .. АУР Lo" MT Date/Time 
اا‎ 

Printed Name: | ... Signature: ids sss - 

Reason:.......... ر ےر رو یجرد‎ SSE EES Date/Time:.. РУ. — O >, 
Accepted By: 

Printed Name: .. О j.. Signature: € 

Reason: 2000224 - fel BJS IOS HSS. ал жада pate/Time: EP. MER... 
me — o —- ы an шо ша чь шо шо чы шш о чш шш шо oU таз өне x FRA. SEA d ee Se oe eeu a ee meu RES m mute 
Accepted By: 

Printed Мате:........................... SgHaturtel—ie n4 к XE кажык Sus 

REASON Sars dun ies secus ee OR Oe e seen ta Date/Time га quate ияк Ез 


Accepted By: 
Printed Names su sia АТ Жэки RES SignatufBe... Iowa om кя жа sy aus тұн 


Accepted By: 
Printed Name: раа 99 Re ed Sxchabureiuoe жаған dee deg k 


Accepted By: 
Printed Names ¿u u РФ Gee See a ЖАС ЫА В ЗОНА е Avnet s иек PREX E 


Accepted By: 
Printed Мате хма Saw See ы qe Ries Siena tured. wah cee Sd серт к 1... .. 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Бааларитевз ахад ааа: әле Date. sas ooa 
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| Field Office Acquiring Evidence Nus Hees. 


| Serial # of Originating Document 


Date Received 


From 


ontributor/Interviewee) — m 


Aes ee —‏ دل 
(Address)‏ 
CT‏ 


(City and State) 


To Be Returned [] Yes Ё No 


Receipt Given Û] Yes A No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
` Federal Rules of Criminal Procedure | 


[1 Yes Ж Мо | 
] Federal Taxpayer Information (ЕТІ) : | 
[1 Yes Vi No 


d Title: bic 
4 


WWE ~ Vichier 


ай 


Reference: 6 
(Comniunication Enclosing Material) 


Description: ПІ Original notes re interview of 


Jud Мот; š 
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UNITED STATES DISTRICT COURT ' 


Page! — District of Connecticut 
UNITED ЅТАТ.:5 OF AMERICA ° JUDGMENT IN A CRIMINAL CASE 
v. CASE NO. 3:05cr29 (SRU) 


USM NO: 16244-014 
JAMES K. BEL... 


Christopher Schmeisser 
Assistant United States Attorney 


John Williams 
Defendant’s Attorney 


THE DEFENDANT: pleaded guilty to count Оле of an Information. 


Acecrdingly the defendant is adjudicated guilty of the following offense: 


Tithe & {jection Nature of Offense Offense Concluded Count 
18:1341 Mail Fraud 10/2000 One 


The following sentence is imposed pursuant ro the Sentencing Reform Act of 1984. 
IMPFJSONMEMT 


The dsfendant is 1 ereby committed to the custody of the United States Bureau of Prisons to bc imprisoned for a total of eight 
months. The senienco of imprisonment is a departure based on information provided to the court pursuant to Fed. R. Crim. P. 32 and 
the de fendant’s extraordinary acceptance of responsibility. 


SUPERVISED RELEASE 


Upon release from imprisonment, the defendant shall be on supervised release for a total term of three years. The Mandatory and 
Standi:rd Conditions of Supervised Release as attached, are imposed. In addition, the following Special Conditions are imposed: 


1. The iefendant shall participate in a program approved by thc Probation Office for mental health treatment. The 
defencanr shall pay all or a portion of the costs associated with treatment, based on the defendant's ability to pay as determined by the 
probation officer, . f 

2. Unul the defendant's criminal debt obligation is paid, the defendant shall not incur new credit card charges or open 
additional lines of credit without the permission of the probation officer, š 

3. The defendant shall provide rhe probatien officer with access to requested financial information. 

4. The defendant shall not possess a firearm, destructive device or other dangerous weapon. 

5. The defendant shall make installment payments of at least $100.00 por month toward the outstanding fine balance. 


CRIMINAL MONETARY PENALTIES 
The defendant mu it pay the total criminal monctary penalties under the schedule of payments as follows: 
Speci; I Assessme з: $100.00 


Fine: $6,000.00 
Restit ition: $953,302.17 (paid in full) 


It is further ordere і that the defendant will notify the United States Attorney for this district within 30 days of any change of name, 
residence or mailit.g address until all fines, restitution, costs and special assessments imposed by this judgment, are paid. 
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Case 3:05-cr-00029-SRU Document43 Filed 05/09/2007 Раде 2 of 3 
Page 2 
JUDICIAL RECOMMENDATIONS TO THE BUREAU OF PRISONS 


That defendant be assigned to a low security level facility ncar CT. 


Phe Defendant Shall Surrender at the Institution Designated by the Bureau of Prisons before 2 p.m. July 18, 2007. 


May 1, 2007 
Date of Imposition of Sentence 


——— 


[8/ Stefan R. Underhill 
Stefan R. Underhill 
United States District Judgc 
Date: May 8, 2007 


RETURN 

Thave executed this judgment as follows: 

Defendant deliverec on to 

a u Cs With a сспібей copy of this judgment 


i = = John F. Bardelli‏ کے 
United States Marshal‏ 


By 
Deputy Marshal 


CERTIF'ED AS A TRUE COPY 
ON THIS DATE | 
Kavin F. Rowe, Сек 
BY: — 
Deputy Clerk 


05/10/07 15:44 FAX 203 579 5550 7  — USAO-BRIDGEPORT 


[007/007 


Page 3 Сасе 3:05-cr-00029-SRU Document 43 Filed 05/09/2007 Раде 3 of 3 
CONDITIONS OF SUPERVISED RELEASE 


In addition to the Stan lard Conditions listed below, the following indicated (M) Mandatory Conditions are imposed: 


MANDATORY CONDITIONS 
Wi (1) The defendant shall not commit uxother federal, state or Таса! offense; 
П (2) The defendan shall not unlawfully possess а controled substance; 


Û (3) "he defendam who is convicted for a domestic violence crime as defincd in 18 U.S.C. section 3561(b) for the first time hall attend a public, 
private, or pri sate non-profit offender rehabilitation program (hat has been арргоуса by the court, in consultation with a State Coalition 


даш Dom stic Violence or other appropriate exports, i£ an approved program ia available within a $0-mile radius of the Icgal residence of 
tbe defendant; 


[1 (4) "The defendan: shall refrain from sny uplawful usc of a controlled substance and submit ro one drug test within 15 daya of release on 
supervised rel zase and at least vwo periodic drug teats thercafler for usc of e controlled substance; 
Û (5) | fn fine is imposed ond has not been paid upon release to supervised release, the defendant shall adhere to an installment schedule to pay thot 
ine 
Ш (6) ‘he defendan . shall (а) make restitution in accordance with 18 U.S.C. sections 2248, 2259, 2264, 2327, 3663, 3663A, aud 3664; and (B) рау 
the assessment imposed in accordance with 18 U.S.C. section 3013; 


Û (7) .A defendant convicted of a sexual offense as described in 18 U.S.C, sections 4042(c)(4) shall report the address wberc the defendant will 
reside and am’ subsequent change of residence to the probation officer responsible far supervision, aud shall register as н sex offender in any 
тате where б.е person resides, Ís employed, carries on а vocation or is в student, 


WE (8) (he defendan: shall cooperate in the collection of a DNA sample from the defendant. 


While on superviscd г lease, the defendant shalt also comply with all of the following Standard Conditions; ' 


STANDARD CONDITIONS 
Q Tho defendant shall not1caye the judicial district or other specified geographic шев without the permission of the court or probation officer: 
2 The defendant shell report to the probation officer as directed by the court or probation officer ond shall submit a truthful and complere written 
*cport within the first five days of cach month; ° Е 
B The defendant ahall answer truthfully nil inquirica by the probation officer and follow the instructiona of the probation officer; ONSE 
4 The defendant shall support the defendant's dependents and meet other family responsibilitics (including, but not limited to, complying with 
she terms of сЗу couri ofder or administrative process pursuant to the law of a arate, the District of Columbia, or апу other nee or 
tertitory of ths United States requiring payments by the defendant for the support und maintenance of any child or of a child and the parent 
А with whom tle child is living); ? 
(5) The defendar t shall work regularly at a luwfol occupation unless excused by the probation officer for schooling, training, or other acccptable 
tcasons; 
@ The defendar t ghall notify the probation officer at least ten days prior'to uny change of residence or employment, 
7 The defendar t shall refrain from excessive use of alcoho! and shall not purchase, posocss, use, distribute, or udminister any controlled 
substance, or apy paraphernalia related to any controlled substance, except us me by n physician; 24. 
(8) The defender | shall not frequent places where conrrolled substaneca are illegally sold, used, istributed, or administered, ог other places 
specie “Мс court; * 2 Я 
(9) The defendar t shall not associate with any peraone engaged in criminal activity, and shall not associate with any person convicted of a felony 
unless tei permission to do во by the probation officer; 
(10) The delenda: г аһа permit а probation officer to visit the defendant at any timo at home or elsewhere and shall permic confiscation of any 
contraband o 2acrved in plain view by the probation officer; 
2 The defendar t shall notify the probation officer within seventy-two hours of bein arrested or queationed by a Jaw enforcement officer, — 
12 Tho. defend a ‘t shall not cater into any agrcement to act as an informer or a special agent of a law enforcement agency withour thc permission 
of thc court; š 
(13) The defenda:.t shall pay the special assessment imposed or adhere ro a court-ordered installment schedule for the payment of the special 
assessment 
(4) The defendit shall notify the probation officer of any material change in (he defendant's economic circumstances that might affect the 


defendant's «bility to рау any unpaid amount of restitution, fines, or special asscapments, 


The Jefendant shall report to the Probation Office in the district to which the defendant is released within 72 hours of 
release from the custody of the 0.5. Bureau of Prisons. Upon a finding of a violation of supervised release, 1 understand that 


the court may C ) revoke supervision and impose n term of imprisonment, (2) extend the term of supervision, and/or (3) 
той: ѓу the conditions of supervision. 


These conditions have been read to me. 1 fully understand the conditions and have been provided a copy of them. 


(Signet) 
Defendant Date 


U.S. Probation Officer/Designated Witness Date 
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UNITED STATES DISTRICT COURT 
Page 1 District of Connecticut 
peL __ stricto Connecticut — — n 
UNITED STATES ОЕ AMERICA JUDGMENT IN A CRIMINAL CASE 
v, CASE NO. 3:06cr158 (SRU) 


USM NO: 75819-014 
STANLEY SHENKER 


Christopher W. Schmeisser 
Assistant United States Attorney 
Andrew B. Bowman 
Defendant’s Auorney 


THE DEFENDANT: pleaded guilty to count One of the Superseding Indictment. 


Accordingly the defendant is adjudicated guilty of the following offense: 


Title & ection Nature of Offense Offense Concluded Count 
Conspiracy to Commit 
18:371, 2314 and 1343 Interstate Transportation of 03/2003 One 
Money Obtained by Fraud 


The ft Nowing sentence is imposed pursuant to the Sentencing Reform Act of 1984, 
IMPRISONMENT 


The defendant is t ereby committed to the custody of the United States Burcau of Prisons to be imprisoned for a total of thirty-three 
months. 


SUPERVISED RELEASE 


Upon :eleasc from imprisonment, the defendant shall be оп supervised release for a total term of three years, The Mandatory and 
Stand: rd Conditio as of Supervised Release as attached, arc imposed. In addition, the following Special Conditions are imposed: 


1. The defendant shall participate in a program approved by the Probation Office for mental health treatment. The 
defendant shall pa r all or a portion of the costs associated with treatment, based on the defendant's ability to pay as determined by the 
probation officer. 

2. The defendant shall pay restitution in the amount of $2,867,239,55, payable imracdiatcly, Any amount that remains 
unpaid at the comriencement of the term of supervised release must be paid at a rate of no less than $1,000.00 per month, or 15% of 
defendant's gross .nonthly income, whichever is higher. 

3. The defendant shall nor incur new credit card charges or o pen additional lines of credit without the permission of thc 
probat on officer. 

4. The defendant shall provide the probation officer with access to requested financial information. 

5. The Jefendant shall not possess a firearm, deatructive device or other dangerous weapon. 


4 


CRIMINAL MONETARY PENALTIES 
The defendant must pay the total criminal monetary penalties under the schedule of payments as follows: 


Special Assessment: $100.00 
Restitution: $2,867,239.55 


The defendant is o-dered to turn over to the victim, World Wrestling Federation Entertainment, Inc., c/o Jerry S. MeDevitt, Esq., 
Kirkpa sick & Loc'thart Preston Gates Ellis, Henry W. Oliver Building, 535 Smithfield Street, Pittsburgh, PA 15222-2312, the 
following sums detailed ou page one of a letter dated 3/26/07 from Andrew В. Bowman, Esq. to Jerry S. McDevitt, Esq.: 
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1. $161,155.00 currently held in Bank of America account no. (last four digits) 8363. 


2. $400,000.00 from the SSAI Charles Schwab account no. (last four digits) 0729, without prejudice to further procecdings, 
either in this cour. or elsewhere, to determine the ownership of the remaining funds of approximately $283,000.00, 


3. THQ stock in Charles Schwab account no, (last four digits) 1896 in the amount of approxiruately $213,000.00. 
The above funds are to be paid within 14 days of entry of this judgment. 


It is further ordered that the defendant will notify the United States Attorney for this district within 30 days of any change of name, 
résidence ог maili 3g address until all fines, restitution, costs and special assessments imposed by this judgment, are paid. 


JUDICIAL REC OMMENDATION(S) TO THE BUREAU OF PRISONS 


The defendant be xssigned to а low sccurity level facility that can adequately deal with defendant’s health needs, near his home in 
Florida, 


The Defendant S 1all Surrender at the Institution Designated by the Bureau of Prisons before 2 p.m. July 18, 2007, 


——— — n . ——————————Mayi2007 (| 


Date of Imposition of Sentence 


isi Stefan R. Underhill 
Stefan R. Underhilf 
United States District Judge 
Date: May 8, 2007 


RETURN 


I have cxccuted this, udgment as follows: 


مم 


Defend ant delivered on to 


a with a certified copy of this judgment, 


John F. Bardelli 
United States Marshal 


By 
Deputy Marshal 


CERTIFIED AS A TRUE COPY 
ON THIS DATE _ 
Kevin F. Rowe, Clark 
BY: ____ 

Deputy Clerk 
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CONDITIONS OF SUPERVISED RELEASE 


In addition to the Standard Conditions listed below, tha following indicated (B) Mandatory Conditions nre imposed: i 


MANDATORY CONDITIONS 
ш (1) The defenda ıt shall not commit another federal, state or local offenac; , 
Û (2) The defenda ıt shall not unlawfully possess a controlled substance: 


П (3) Түс dofenda it who is convicted for a domestic violence crime аз defined in 18 U.S.C. section 3561(b) for the first time shall attend a public, 
rivate, or private non-profit offender rehabilitation program that hus been approved by the court, in consultation with а Stato Coalition 
gina Don.cstic Violence ог other appropriate expers, if an approved program ін aváijable within а 50-mile radius of the Tegal residence of 
€ defendant; 


П (4) The defendant shall refrain from any unlawful use ofa controlled substance and submit to onc drug test within 15 days of release on 
supervised n lease and ut least two periodic drug tests thereafter for usc of а controlled substance; 


Ú (5) u 0 fine is intposcd and has nor been puid upon release to supervised release, thc defendant shall adhere to an installment schedule to pay that 
Ine; 


|| (6) The defendant shall (A) make restitution in accordance with 18 U.S.C. aections 2245, 2259, 2264, 2327, 3663, 3663A, and 3664; and (В) pay 
the assessme at іпурозсд in accordance with 18 U.S.C. section 3013: 


C (7) А defendant zonvicted of a sexual offense as described in 18 U.S.C. sections 4042(c)(4) shall report the address where the defendant will 
reside and ar y subsequent change of residence to the probation officer responsible for supervision, and shall register as а sex offender in any 
State where the person resides, is employed, carries of а vocation or is a student, 


Ш (5) The defendant chal cooperate іп the collection of a DNA sample from the defendant. 
While on supervised 1 clense, the defendant shall also comply with all of the following Standard Conditions: 
STANDARD CONDITIONS 


| D The defendat abal) not leave the judicial district or other specified geographic area without the permission of the court or probation officer; 

2 The defendas.t shall тороо the probation officer as ёйгсстёа by the court or probation officer und shall submit a truthful and complete written 
report within the firat fivc daya of cach month; ` А I 

9 The defendar t shall answer truthfully all inquiries by the probation officer and follow the instructions of the probation officer; ЖАР 

4 The defendat t shall support the defendanr's dependents and шесі other family responsibilitics (including, but not limircd to, complying with 


the terms of i ny court order or administrative process purauant to the law of n state, the District of Columbia, or any other possession or 


territory of ite United Statea requiring payments by the defendant for the support and maintenance of any child or of a child and the parent 
with whom the child is living): . 


(5) The defendar t shall work regularly at a lawful occupation unless excused by the probation officer for schooling, training, or other acceptable 
TUSON; 
6 The defendar t shall notify the probation officer at least ten days prior to any change of residence or employment; : - 
7 The defendar t ahall refrain from excessive usc of alcohol and shull not purchasc, possess, use, distribute, or administer nny controlled 
substance, or any paraphernalia related to any controlled substance, except ан pregeribed by u physician; 
(8) The екпш t anall not frequent places where controlled substances arc вау sold, used, istributed, or administered, or other places 
apcci the court; 
(9) The defender t shall not associate with any persons engaged in criminal activity, and shall not associate with any person convicted of a felony 
unless grante i permission to do so by the probation officcr; | 
(10) The defendart shall permit n probation officer to visit the defendanr.ar any time at home or e]sewltere and shall permit confiscation of any 
zontraband o served in plain view by the probation officer; ў 
ü 2) The defendant shall попу the probation officcr within seventy-two hours of being utrested or questioned by a law enforcement officer; — 
12 ne defendant shall not enter into any agreement to act as an informer or a spocial agent of a law cnforcament agency without the permission 
of the court; 
(13) The endarê shall pay the special assessment imposed or adhere to а court-ordered installment schedule for the payment of the special 
assessment; 
(14) The defendant shall notify the probation officer of any material change in the defendant's economic circumstances that might affect the 


defendant's a silty to pay any unpaid amount of restitution, fines, or special nascasments, 


The defendant shall report to the Probation Office in the district to which the defendant is released within 72 hours of 
release from the custody of the U.S, Bureau of Prisons, Upon a Tinding of a violation of supervised release, Y understand that 


the ccurt may (1) revoke supervision and impose a term of imprisonment, (2) axtend the term of supervision, and/or (3) 
modify the conditions of supervision. 


These conditions have been read to me. Х fully understand the conditions aud have been provided a copy of them. 


(Signed) ызы NN 
Defendant Date 


————————————— БЕНИ 
U.S. Probation Officer/Designated Witness Date 
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U.S. Depart ment of Justice 


Kevin J, O'Connor 
United States Attorney 
District of Connecticut 


Brien McMahon Federal Building 


915 Lafayette Boulevard, Room 309 (203) 696-3000 
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www.usdej.gov/usao/ct 
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10:29:50 FD-192 Page 1 
Title and Character of Case: 
b6 
[Ж е, 
BELL CONSULTING 
Date Property Acquired: Source from which Property Acquired: 
FORENSIC EXAM 
04/20/2004 
Anticipated Disposition: E 27 Сазе — 
Description of Property: Date Entered 
iB 7 
b3 
Barcode: E02120519 Location: ЕССІ ROWA S15 04/23/2004 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


Barcode (202126514 


Case ID . : 
Printed Name: . — КЕТЕ Signature 

7 

Reason:..Collected....................... DR noces ds dr n 
Printed Name:... ... Signaturel ee ee es bic 
веавоп:............. SORE Date/Time: ` D رد‎ t. OBO. m. 
ES Signature: gs 
22 (атар <... Date/Time:. ZAAT. .22074.... 


Printed Name:. 


Reason:....... O EER ` 
Accepted By: ; 
Printed Мапе:........................... біппасиге:.........:.....---...... 
Pessens ыла Мак OO SEU a ae екен Date/Time:...... ырқы 
Accepted Ву: 
Printed Мапе:........................... білпасцге:...............-........ 
PES SOM ise hoe eS ee boa ҒЫ Че E SR Date/Time:.............i...... 
Accepted By: 
Printed Капе:........................... біпспайиге:.......-....-............ 
REASONS 6 о 0 ез жы кк кА РА pia a Ені ЖЕЖ Гасе/Тіпе:.................... 
Accepted Ву: 
Printed Мапе:........ ——— m Signatures... enhn ttn 
ROS quc asc aec s pud ее eater pon e Date/Time:...... eleg te 
Accepted By: | 
Printed Мапе:..........................?. Signature:......................... 
Бёавой 4 ¿us ше к ET IL LLL LII LL LL iv Рабе/Тіпе:.................... 
Accepted Ву: | 
Printed Name:........................... біппасиге:..........-.-.-.--%....... 
Резвон аэзЕкЕзжа каз КҰРА Ты Oe ПРаке/Тіпе:.................... 
Accepted By: | 
Printed Name: ЖОООК ОКЕ СЕМ o Signature:s..... eene ttt nn 
Reasons. ar SURE EEO RED Ы ERE RUE 2. Раке/Тіпе:.................... 
WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 
болысы ЕЕЕ aise el v жа pate:.......-. 


' Signature: 


04/23/04 ICMIPRO 
10:35:38 FD-192 Page 
Title and Character of Case: 
b6 
BELL CONSULTING ые 
Date Property Acquired: Source from which Property Acquired: 
FORENSIC EXAM 
04/22/2004 
Anticipated Disposition: pum ЕС Саѕе Agent: Бе 
BIC 
Description of Property: Date Entered 
1B 8 
b3 
Barcode: E02120518 Location: ЕСС1 ROW4 515 04/23/2004 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE C. ` 


1 
1 


Chain of Custody FD-192 


Case ID . : 305c - Jue - И2Ғ Barcode . : ESTE 


Accepted By: 
Printed Мате:. 1 dw we ee ees 


Accepted By: 
Printed Name:...L___  ].. 


шу — 
Printed Name:.. ЖЕ 


Accepted By: | 
printed Мапе:........................... Signature:............ III 


Accepted By: 
printed Мапе:........................... біапағчге:..................-- n t 


Accepted By: 
Printed Мапе:........................... Signature:..... ee ttn 


ынны E cue MID c ud cse - 


Accepted By: 
Printed Мапе:........................... Signature:isseeuk e eee ets ern 


Accepted By: 
Printed Мапе:.........................-.- Зілпағике:...............-..-.-.... 


Accepted Ву: š 
Printed Мапе:.........................ӛ??. Әбіспасиге:..........-.-...........». 


Accepted By: | 
Printed Name: ——— n ера 


10/14/04 ICMIPROL 
10:21:11 FD-192 Page 1 


Title and Character of Case: 


NENNEN 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


1 


10/06/2004 
Anticipated Disposition: Acquired Ву: Case Agent: 
Description of Property: Date Entered 
1B 12 
Barcode: E03670235 Location: EEC Roc “Т <2? 10/14/2004 


e 


PACKAGE COP: 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


5 


~ 
e 


b3 


FD-192 (Rev. 3-04-02) 


E FBI EVIDENCE DATA-LOADING FORM 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of 
evidence. 


Type of Evidence being submitted: Warning - special handling 
Cl General Evidence 0 Firearms О Body Fluids Ll Other 
[C] Valuable Evidence ГІ вој L Whole Blood 
C] Drug Evidence П HAZMAT 457 
LY CART H = / О Enviro. 
Case ID: л E 2 Pe 
Ж т EN І Ж j 
Person Acaniring Evidence: Date Acquired: * Time Aciuired: _, | b6 


p7C 
| 11H eq 
Source from which evidence acquired: 
[Person's name/job title/company/address] 


T d š Ыт Ae f P 
vas - — - 


Anticipated Disposition: Forfeiture Éoieitial: 


Е, yes E No 


Federal Taxpayer Information: 


L] Yes О No 


Sealed By: [printed name] 


py? Drug Package Weight: 


Estimated Dollar Value: Fog j у 
as š £ Н > Tow 
Ж = Е S i с 
Complete шш Evidencf: lense in Я "d 


b3 


/£/7- 


This form is to be used as a data-loading form only. ECT is to discard this form when the information contained herein has been entered into 
Evidence Data Base. 


DeN RIO / 


Accepted By: 
Printed Name: 


Accepted By: 
Printed Nam 


Accepted By: 
Printed Name:.. 


Reason: . «С Аме е...т./йбасбере.. ,Хала..... Date/Time: p ro LOOPY | 


"iue mee 22 = x 
Printed Name: .... Signature:  б5>4 


10/25/04 ICMIPRO1 
15:01:21 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 
Date Property Acquired: Source from which Property Acquired: 
WWE 
10/21/2004 
Anticipated Disposition: i : Agen 
Description of Property: Date Entered 
1B 13 
b3 
Barcode: E03670293 Location: ECC1 ROW 527 10/25/2004 
Rous Y 
(55; 
Case Number:  196D-NH-42441 — [2 


Owning Office: NEW HAVEN 


PACKAGE COPY 


Chain оЁ Custody FD-192 


Case. ID . : 1460- yp- day Í = ۵2 Barcode 


Printed Name: Signatur 


Accepted By: 
Printed Name ignature 


reason: . МТ desea ASE ЕОР ИТЕ рабе/тіпе:19/2:9 0: 


Printed Name:. . Signature : 


Reason:.... Soage: . . асвер. FE. ... Date/Time: eat. LOOO 
Accepted By: 

printed Names... [ ].. Signature 

Reason:....... Aem mese. (SEL. SEP... Date/Time: . 24/02... . 220b... . 
Accepted By: f 

Printed NAME SSS ене тика ж RE WES Blguabures 225-і кже dub ЛЫ» 

Reson: oa veste futurs Sas Ra dE МАҚ ee a d aa Бәсе ТІНЕ СИРИ 


Accepted By: 
Printed Маше tas sue QUEUE egre de Signature ыш ик yee ыр а YI ss 


Goniplaint Form Š E 
FD-71 (Rev. 3-27-95) d 


NOTE: Hand print names legibly; handwriting satisfactory for remainder. 
Indices: [D] Negatives... ], See below 


Character of case 


NIPCIP 


Subject's name and aliases 
UNSUB (S) 
SLTESMI TH . COM 

RED WRESTLING FEDERATION 


[0 Protect Source 


Complaint е 


L Personal eg oom Date 08/17/00 Tim, 10:15A | 


ШИ: : қасың : == | = - с 
> 


Scars, marks and other data 


Employer Address Telephone 


Vehicle Description 


Facts of Complaint 


Complainant © is ; NUN at SITESMITH.COM. C's bic 
company provides computer infrastructure management for a variety of 


companies. One of C's clients, the World Wrestling Federation (WWF) has 
suffered an unauthorized computer intrusion into their computer systems 
administered by SITESMITH. C advised that the WWF is one of the top 25 
visited websites on the internet and their web traffic was interrupted as 
a result of the intrusion. C also advised that 1 machine was affected by 
the intrusion and hack tools were found on 15 - 16 other machines. C 
stated that the intrusion occurred from a Dayton Ohio ISP. SITESMITH has 
been in contact with the owner of the machine belonging to that IP 
address who denies having any knowledge of the intrusion. C believes the 
intrusion occurred though a network buffer.overflow exploit. C advised 
that their system runs Linux 6.2 as a front-end interface. 


C adi 
the WWF would b 
[ho is-Iocated in 
È 


Address of Subject 


2g 
2% 
4 
n 

A 


Do not write in this space. 


Connecticut. 


бр 
So 


REOPEN) ‹ САВЕ 52864 
Ca 


AUG 1 7 2000 


FBI — NEW YORK 


(OR 


V (Complaint received by) BLOCK STAMP 


dono wam see лене „з 2- — ое IRL 2 


жзаңа 9 —— әле 


FD-340a (Rev. 11-12-89) O o 


(Titte} 


BAA - NY ATCHOO 
шше No CASTA" IN oA 
Date 
Filed Disposition b6 
ç be 


E 


3 

93 

© 

€ 

e 

[ / 

C) 

ГА 

t 

A 

f 
с 
J 
о 


\ 
m. Ф. Фе! Eoi W XC UN [Ke PAL Sy CTAR 
D ` 
pl 1 “NOS абы сақа Бел Sore Sake Seiko EE 


Im {кү 
Ee] 


H 
t 


КА 


| 


iu 


FD-340b (Rev. 2-5-93) 


Date 


From 


1/60 


K5 v9 [А OF 


(Address of Contributor) 
e Ne 2 


C CAS 


To Be Returned, О Yes И № 


` Receipt Given О Yes No 


МРе (P 
00:Ч 


Reference: 


Description: 


Grand Jury Material - Disseminate Only Pursuant 


(Communication Enclosing Material) 


ет” 


Universal Case File Number 2424 ^W = (Ам 
Field Office Acquiring Evidence Nye р 
Serial # оѓ Originating Document 


4 to Rule 6 (e), Federal Rules of Criminal Procedure b 6 
п Yes A № 
Title: UNS uà (s) 
WWF - Стил 


b76 


` PLEASE po NOT REMOVE E. 
' THIS SLIP FROM A BIT : 


K Ale! 


fee Kon br ad 
| шак A i es (Uv cu I H A 
ie iin ЖҮЗ 


ы fest БҰЗАУ 
lu ET dep = s p 
АЛ || md + PEL. 

К. ОТ ? ааль, 2000014 
ETT ES Оуег low | 


е 


H 
Ша ec cee A ar س کک ر‎ RE .- 


imo eds аланы ы EL S сақы rae 


FD-340b (Rev. 2-5-93) | Ñ 2 ) 


Universal Case File Number 2 SEK Aly =2 Jb чор 


Field Office Acquiring Evidence, Aye 
Serial # of Originating Document 


i AJ x Oe. of Contributor) , . NP 
By _ Sa | = | 
(Мате ої Special Agent) 
To Be Returned O Yes [Z'No 
Receipt Given D Yes Мо 
Grand Jury Material - Disseminate Only Pursuant 
to Rule 6 (e), Federal Rules of Criminal Procedure 
D Yes И No 
Title; уме (< sN; 
мәмле - МЛ Лл. 
Ми p «PF 
Со WY 


Reference: 
(Communication Enclosing Material) 


Description: ІП Original notes re interview of 


smith 


m 


SiteSmith, Inc. 
450 West 15th St., 5th Floor 
New York, NY 10011 


@sitesmith.com 
.9300 main 


WWW.sitesmitn. 


PLEASE D DO NOT 
THIS SLIP FROM: — | 


Smith 


b6 fi 


SiteSmith, Inc. BIE | 


450 West 15th St., 5th Floor 
New шаны! МҮ 10011 


[ bsitesmith. com 
212.675.9300 main 


SITES DON'T WORK WITHOUT US. 


SITES DON'T WORK WITHOUT US. 


From: Fs S Om 
Sent: — — 7, :30 PM 


Subject: Someone changed one of the ACL's 


X-Sieve: 
cmu-sieve 1.3 


Return- I 
sitesmith.com> 
Received: 


from mailbox.sca1.sitesmith.com (localhost 


[L þby mailbox sitesmi (Postfix) with 


ESMTP id Mon, 7 Aug 2000 06:47:56 -0700 
(PDT) 
Delivered-To: 
@sitesmith.com 
Received: 
| from zeus (unknown [by 
| mailbox.si i ix) wi MTP id 


| sitesmith.com>; Mon, 7 Aug 
2000 06:47:52 -0700 (PDT) 
Date: 
Mon, 7 Aug 2000 09:47:26 -0400 (EDT) 


Fr 
T — —bstesmih com 


X-Sender: 
eus.corp.sitesmith.com 
To: 
int-wwf List Tr  Bsitesmith.com» 
Message-ID: 
eus.corp.sitesmith.com> 
MIME-Version: 
1.0 
Content-Type: 
TEXT/PLAIN; charset-US-ASCII 
Subject: 
wwf arrowpoint 
Sender: H 


\ 


Precedence: 
bulk 
List-Id: 


‚Шины al .sitesmith.com> 
X-BeenThere: 


[  Bmailbox.scat.sitesmith.com 


X-Mozilla-Status: 
8003 
X-Mozilla-Status2: 
| 00000000 
| X-UIDL: 


b6 
b"7C 


Hash: SHA1 


two things missing from arrowpoint config.. 


acl 1 /clause 254 - "deny any any" is gone....but arrowpoint denies by 
default anyway... 


command logging is gone... 


just questions to changes... 


@sitesmith.com 
New York Cit 
Office Phone 
Customer Care Center 888.898.7667 


Version: PGPfreeware 5.0i for non-commercial use 


ailing list 
mailbox.sca1.sitesmith.com 
http://mailbox.sca1.sitesmith.com/mailmarlistin |] 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: [ — 1 fsitesmitncom] ° 


Sent: 0 1:30 PM 
To: 
Subject: inking a one liner Is going to make me leave him alone 


X-Sieve: 
cmu-sieve 1.3 


Return- : 
@nav-international.com> 
Received: 


г[ — havistar.com (mail.navistar.com 


===) by ара ааа ОШ. 
with ESMTP іа for 


itesmith.com>; Mon, 7 Aug 2000 05:20:42 -0700 
(PDT) 
Received: 


navistar.com> for 
Itesmith.com; Mon, 7 Aug 2000 07:22:25 CST 
Received: 
b navistar.com with Internet Mail Service 
d Mon, 07 
Aug 2000 07:22:24 -0500 
Content-return: 
allowed 
Date: 
Mon, 07 Aug 2000 07:23:18 -0500 
From: 
[ —— — — ——— [@nav-international.com> 
Subject: 
RE: Is this a real email address?? 
To: 


LT Bslitesmith.com» 


Message-ID: 


p—————— SUE COE 
-Version: 


1.0 
X-Mailer: 
Internet Mail Service| | 
Content-type: 
multipart/alternative; 
boundary="----_=_NextPart_001_01C0006A.44DA8980" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 


L 1 


iscom.net was NOT hacked by comandur.com. tomr.siscom.net IS 
comandur.com. 


Thank you. :) 


From: sitesmith.com] 


Sent: Eri 4, 2000 4:57 PM 
To: 
Subject: Re: Ts this a real email address?? 


The site that was hacked was siscom.net, the reason I link you to 
itis because you hacker, which means you must 


have his info. 


> You can link me to bind j because i am.. 
> 


> How you can link me to the compromised site, i have no clue. | dont 
> know which site is being hacked or was hacked. 


> Subject: Re: Is a real email address?? 


> Well, it would be nice to know why 1 was able to link your name to 
> both 


> the compromised site (which І can confirm is compromi j 
> anonymous and tell me what you see) and you being 
> 


> 
>> 
>> 


> > Oh.. i see, If there is anything you need from me, let me know. 
>> 


> > From itesmith.com] 
> > Sent: Eri 4, 2000 1:44 PM 

> > To: 

> > Subject: Re: 15 this а real email address?? 

>> 


> > uh, yeah except the motherfucker is hacking my site. 
>> 


>>> 

> > > correct.. Ііш| — — ]comanaur.com, whatever content is on 
> the 

>> 

> > > page is his own fault.. 

>>> 

> > > afaik, iscom.net == comandur.com.. so nothing unusual is 
> going 

>> 

> > > on here. 4 

>>> 


> > > From itesmith.com] 
> > Sent Friday, August 04, 2000 1:29 PM 


4 


>> > То 


> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Sorry to leave you in the dark. comandur.com IS the hacker, and 

> you 

>> 

>> J Пт So | may need some help from you. The victim 
> is 

>> 


> > > siscom.net ..... check ou iscom.net 
> > > 


>>> 

>> >> 

> >>> 

> > > > Okay, everything was going good for my day, then you mention 
> > this.. 

>>>> 

> >>>... then withhold details, like "One of the 350 websites you 
> host 

> > > was 

> > > > hacked" 

>> >> 

> > > > eluding to 1115.net as the site that was hacked.. but yet i can 
> > find 

>>> 

> > > > no signs anywhere... 

>> >> 

> > > > If you would be so kind, please email me a link to a hacked 
> page, 

> > so 

>>> 

> > > > some other proof.. This is driving me crazy. 

>> >> 

> > > > 

>>> 

>>> 

> > > > Navistar International 

>>>> 


> > > > To: 


> > > > Subject: Re: Is this a real email address?? 
>>>> 


>>>>Asiteyo[ ^ ]weshacked.. 


>>>> 

С на wrote: 
> >>> 

> >>> > 

> >>> > 


> > > > > which site was hacked? and what makes you think it was hacked? 


> 
>>> >> 

>>>>>---- Original Message----- 

> > > > > From sitesmith.com] 

> > > > > Sent ЕЦ 04, 2000 12:18 PM 

>>> >> To 

> > > > > Subject: Re: Is this a real email address?? 

>>> >> 

> > > > > Apparently you didn't understand my response. Your email is 
> > > > plastered 

> > > > > all over a website that was hacked, and more importantly, you 


@ ; e 


>| 
> 
> > > > > for 


> > > > > this hacked website. 
>>> >> 


>> >>> 
>>>>>> 
>>>>>> 


> > > > > > what makes you think that? 
>>>>>> 


> > > > > > From: sitesmith.com] 
> > > > > > Sent: Friday, August 04, 2000 11:19 AM 

455554. EM 

> > > > > > Subject: Re: Is this a real email address?? 

>>> >>> 

> > > > > > Actually, | would like to be even more specific...... | got 


> > your 
>>> 


> > > > > email 
>>>>>> 


> > > > > > address from a hacked website. 
>>>>>> 


>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > Yes | do... get my email address from whois information? 
>>>>>>> 

>>> >> >> We OriqinaLMessaqe--... 

> > > > > > > From: 
> > > > > > > Sent: 
>> >> > >> Т 
> > > > > > > Subject: 
>>>>>>> 

> > > > > > > Let me ask you something.... .do уои һауе апу affiliation 
> > with 

>>> 

> > > > > > > 1115.net? 

>>>> >>> 

>>>>>>> 

>>>>>>>> 

>>>>>>>> 


> > > > > > > > This HAS to be the weirdest email | have had in a while. 


is a real email address?? 


> 
>>>>>>>> 

> > > > > > > > -----Original Message-—- 

> > > > > > > > Fro itesmith.com] 


> > > > > > > > Sent: Eriday, August 04, 2000 2:10 AM 
— Tof pavistar.com 
> > > > > > > > Subject: Is this a real email address?? 


>>>>>>>> 
>>>>>>>> If this is a real address please respond... 
>>>>>>>> 

>>>>>>>>-- 

>>>>>>>> 

>>>>>>>> 


>>>>>>> 
>>>>>>> 


> > > > > > > > www.sitesmith.com 
> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 

>>>>>>> 

>>>>>>>-- 

>>>>>>> 

>>>>>>> 


>>>>>> 
>>>>>> 
> > > > > > > www.sitesmitn.com 


> > > > > > > "We are the master Internet Craftsmen" 
> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 

>>>>>> 

>>>>>>-- 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 

>>>>>-- 

>>>>> 

>>>>> 

>>>> 

>>>> 

> > > > > WWW.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 


>>>> 
> > > > -- 

>> >> 

>> >> 

>>>> 

>>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
> >>> 

>>> 

>>>-- 

>>> 

>>> 

>> 

>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

> > 

> > 

> 

> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 

> > Сиѕіотег Саге Сепіег (888) 898 7667 


> > 


> ы " 


> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


NEM i 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


mu = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


Еа 


Егот: | bitesmith.com] 
Sent: ursday, August 17, :28 PM 

To: [ | 

Subject: roof that other machines are compromised 


Here you can see someone turned on the portmapper (which | explicitly 
turned off) and is connecting from the backend. 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 
itesmith.com> 
Received: 
from-sitesmith.com (known | °] by 
mailbox.sitesmi х) with ESM TPT 
== Sun, 6 Aug 2000 17:31:49 -0700 (PDT) 
Message-ID: 
itesmith.com> 
Date: 
Sun, 06 Aug 2000 20:30:44 -0700 
From: 
[ — hitesmith.com> 
X-Mailer: 
Mozilla 4.7 [en] (Win98; I) 
X-Accept-Language: 


en 
MIME-Version: 


1.0 
Ti . 
u њо E 
itesmith.com> 
Subject: 
ws3 
Content-Type: 
multipart/mixed; 
boundary="------------ D2CC5124EE81ED3C722B73CA" 
X-Mozilla-Status: 
8001 
X-Mozilla-Status2: 
00000000 
X-UIDL: 
Aug 6 20:35:03 wwf3 portmap[3226]: connect from to 
; request from unauthorized host 
Aug 6 20:35:03 wwf3 portmap[3226]: connect from to 
request from unauthorized host 
Aug 6 20:35:06 wwf3 portmap[3227]: connect from to 
| | request from unauthorized host 
u :35:06 wwi3 portmap[3227]: connect from to 


[p ee: from unauthorized host 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


10 


———————————— HÀ 


From: [—— — — — — - Jitesmith.com] 
Sent: p — — 2000 1:24 PM Й 
То: 2 
Subject: Ome Arrowpoing logs of port 137 spoofed attacks bic 
X-Sieve: 


cmu-sieve 1.3 
Return-Path: 
itesmith.com> 
Received: 
إا حم‎ 


by 


Ca mailbox.sitesmith.com (Postfix) with SMTP id 


sitesmith.com»; Sun, 6 Aug 2000 
12:07:05 -0700 (PDT) 


From: 
a 
T . 
=== "as 


Subject: 
КЕ: [int-wwf] list of facts 
Date: 
Sun, 6 Aug 2000 15:22:12 -0700 
Message-ID: 


EL eara pen 
ME-Version: 


1.0 
Content-Type: 
text/plain; charset-"iso-8859-1" 
Content-Transfer-Encoding: 
7bit 
X-Priority: 
3 (Normal) 
X-MSMail-Priority: 
Normal 
X-Mailer: 
Microsoft Outlook IMO, Build 9.0.2416 
(9.0.2910.0) 
Importance: 
Normal 
In-Reply-To: 
@sitesmith.com> 
X-MimeOLE: 
Produced By Microsoft MimeOLE V5.00.2314.1300 
X-Mozilla-Status: 
8011 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


AUG 6 12:15:22 9/1 125415 ACL-7: 
AUG 6 12:15:22 6/1 125416 ACL-7: NO ACL rule match! Discarding packet 
AUG 6 12:15:22 6/1 125417 ACL-7: UDP SrcPort: 137 DestPort: 137 


Ф 11 8 


2:15:22 6/1 125418 ACL-7 
2:15:22 6/1 125419 ACL-7 
2:15:22 6/1 125420 ACL-7: 
2:15:22 6/1 125421 ACL-7: NO ACL rule match! Discarding packet 
2:15:22 6/1 125422 ACL-7: NO ACL rule match! Discarding packet 


2:15:22 6/1 125423 ACL-7: оп: 137 
2:15:23 6/1 125424 ACL-7: 
2:15:23 6/1 125425 ACL-7: 


2:15:23 6/1 125426 ACL-7: 
2:15:23 6/1 125427 ACL-7: NO ACL rule match! Discarding packet 


2:15:23 6/1 125428 ACL-7: ort: 137 
2:15:23 6/1 125429 ACL-7: 
2:15:23 6/1 125430 ACL-7: 


1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

12:15:23 6/1 125431 ACL-7: 

12:15:23 9/1 125432 ACL-7: NO ACL rule match! Discarding packet 
12:15:23 9/1 125433 ACL-7: UDP  SrcPort: 767 DestPort: 137 
12:15:23 9/1 125434 ACL-7: 

12:15:23 9/1 125435 ACL-7: 

12:15:23 9/1 125436 ACL-7: 

12:15:23 6/1 125437 ACL-7: NO ACL rule match! Discarding packet 
12:15:23 6/1 125438 ACL-7; : 137 
12:15:23 6/1 125439 ACL-7 

12:15:23 6/1 125440 ACL-7 

12:15:23 6/1 125441 ACL-7: NO ACL rule match! Discarding packet 
12:15:23 6/1 125442 АСІ-7; ort: 137 
12:15:23 6/1 125443 ACL-7 

12:15:23 6/1 125444 ACL-7 

12:15:23 6/1 125445 ACL-7: 

12:15:23 6/1 125446 ACL-7: NO ACL rule match! Discarding packet 
12:15:23 6/1 125447 ACL-7: UDP SrcPort: 137 DestPort: 137 
12:15:23 6/1 125448 ACL- 

12:15:23 6/1 125449 ACL- 

12:15:23 6/1 125450 ACL-7: 

1 

12:15:23 9/1 125452 ACL-7: UDP SrcPort: 767 DestPort: 137 
12:15:23 6/1 125453 ACL-7: NO ACL rule match! Discarding packet 
12:15:23 6/1 125454 ACL-7; 
12:15:24 6/1 125455 ACL-7 
12:15:24 6/1 125456 ACL-7| 
12:15:24 9/1 125457 ACL-7: rule match! Discarding packet 
12:15:24 9/1 125458 ACL-7: UDP  SrcPort: 767 DestPort: 137 
12:15:24 9/1 125459 ACL-7: 

12:15:24 9/1 125460 ACL-7: 

12:15:24 9/1 125461 ACL-7: 

12:15:24 9/1 125462 ACL-7: NO ACL rule match! Discarding packet 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 


2:15:24 9/1 125463 ACL-7: қ stPort: 137 
2:15:24 9/1 125464 АСІ-7 
2:15:24 6/1 125465 ACL-7: Tule Match! Discarding packet 


2:15:24 6/1 125466 ACL-7: NO ACL rule match! Discarding packet 


2:15:24 6/1 125467 ACL-T: : 137 
2:15:24 6/1 125468 ACL-7: 
2:15:24 6/1 125469 ACL-7: 


2:15:24 6/1 125470 ACL-7: 

2:15:24 9/1 125471 ACL-7: NO ACL rule match! Discarding packet 
2:15:24 9/1 125472 ACL-7: UDP 5гсРог 11 DestPort: 137 
2:15:24 9/1 125473 ACL-7: 

2:15:24 9/1 125474 ACL-7: 

2:15:24 9/1 125475 ACL-7: 

2:15:24 6/1 125476 ACL-7: МО ACL rule match! Discarding packet 
2:15:24 6/1 125477 ACL-7: UDP  SrcPort: 137 DestPort: 137 
2:15:24 6/1 125478 ACL-7: 

2:15:24 6/1 125479 ACL-7: 

2:15:24 6/1 125480 ACL-7: 

2:15:24 9/1 125481 ACL-7: NO ACL rule match! Discarding packet 
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6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 


oO 


2:15:23 9/1 125451 ACL-7: NO ACL rule match! Discarding packet . 


b6 
b7C 


6 12:15:24 9/1 125482 ACL-7: UDP SrcPort: 767 DestPort: 137 

6 12:15:24 6/1 125483 ACL-7: NO ACL rule match! Discarding packet 
6 12:15:24 6/1 125484 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 12:15:24 6/1 125485 ACL-7: 

6 12:15:24 6/1 125486 ACL-7: 

6 12:15:25 6/1 125487 ACL-7: NO ACL rule match! Discarding packet 
6 12:15:25 6/1 125488 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 12:15:25 6/1 125489 ACL-7| 

6 12:15:25 6/1 125490 ACL-7 

6 12:15:25 6/1 125491 ACL-7: 

6 12:15:25 9/1 125492 ACL-7: NO ACL rule match! Discarding packet 
6 12:15:25 9/1 125493 ACL-7: UDP  SrcPort: 767 DestPort: 137 

6 12:15:25 9/1 125494 ACL-7| 

6 12:15:25 9/1 125495 ACL-7 

6 12:15:25 9/1 125496 ACL-7: 

6 12:15:25 9/1 125497 ACL-7: NO ACL rule match! Discarding packet 
6 12:15:25 9/1 125498 ACL-7: UDP  SrcPort; 767 DestPort: 137 

6 12:15:25 9/1 125499 ACL-7: 

6 12:15:58 6/1 126254 ACL-7: NO ACL rule match! Discarding packet 
6 12:17:46 6/1 127254 ACL-7: NO ACL rule match! Discarding packet 
6 12:18:41 6/1 128254 ACL-7: NO ACL rule match! Discarding packet 
6 12:19:32 6/1 129254 ACL-7: . 

6 12:20:46 6/1 130254 ACL-7: NO ACL rule match! Discarding packet 
6 12:21:33 6/1 131254 ACL-7: NO ACL rule match! Discarding packet 
6 12:22:03 6/1 132254 ACL-7: 

6 12:22:09 9/2 132452 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:10 9/2 132481 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:11 9/2 132501 ACL-7: UDP SrcPort: 3254 DestPort: 161 

6 12:22:12 9/2 132530 ACL-7: UDP SrcPort: 3254 DestPort: 161 


6 12:22:12 6/1 132540 АСІ-7; 137 
6 12:22:12 6/1 132541 ACL- 
6 12:22:12 6/1 132542 ACL- 


6 12:22:12 6/1 132543 ACL-7: 

6 12:22:12 6/1 132544 ACL-7: NO ACL rule match! Discarding packet 
6 12:22:12 6/1 132545 ACL-7: Port: 137 

6 12:22:12 6/1 132546 ACL-7: 

6 12:22:12 6/1 132547 ACL-7: 

6 12:22:12 6/1 132548 ACL-7: 

6 12:22:12 6/1 132549 ACL-7: NO ACL rule match! Discarding packet 
6 12:22:13 9/2 132560 ACL-7: UDP SrcPort: 3254 DestPort: 161 

6 12:22:13 9/2 132565 ACL-7: UDP SrcPort: 3254 DestPort: 161 

6 12:22:15 9/2 132600 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:15 9/2 132605 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:17 9/2 132654 ACL-7: UDP SrcPort: 3254 DestPort: 161 

6 12:22:17 9/2 132659 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:19 9/2 132699 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:19 9/2 132704 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:21 9/2 132754 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:23 9/2 132823 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:25 9/2 132858 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:27 9/2 132903 ACL-7: UDP  SrcPort: 3254 DestPort: 161 

6 12:22:39 6/1 133254 ACL-7: NO ACL rule match! Discarding packet 
6 12:23:22 6/1 134254 ACL- 

6 12:23:56 6/1 135254 ACL- 

6 12:24:31 6/1 136254 ACL-T: 

6 12:25:07 6/1 137254 ACL-7: 

6 12:25:56 6/1 138254 ^. |== === 

6 12:26:34 6/1 139254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 12:27:06 6/1 140254 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 12:27:53 6/2 142254 ACL-7: TCP SrcPort: 60987 DestPort: 566 

6 12:28:34 6/1 148254 ACL-7: ТСР SrcPort: 60987 DestPort: 887 

6 12:28:47 9/1 150254 ACL-7 

6 12:29:46 9/2 159254 ACL-7: rule match! Discarding packet 
6 12:30:07 9/2 162246 ACL-7: TCP SrcPort: 60989 DestPort: 254 
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AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 


6 12:30:21 6/2 164254 ACL-7: NO ACL rule match! Discarding packet 
6 12:31:26 6/1 168254 ACL-7; 

6 12:34:23 9/2 169061 ACL-7 

6 12:34:24 6/2 169084 ACL-7; UDP  SrcPort: 53 DestPort: 2540 

6 12:34:24 9/2 169089 ACL- 

6 12:34:25 6/1 169108 ACL-7; : : 2541 

6 12:34:26 9/2 169113 ACL-7 

6 12:34:28 6/1 169117 ACL-7: UDP SrcPort: 53 DestPort: 2541 

6 12:34:29 9/2 169121 ACL-7: UDP SrcPort: 53 DestPort: 2542 

6 12:34:30 9/1 169125 ACL-7: ШОР SrcPort: 53 DestPort: 2543 

6 12:34:31 6/2 169134 ACL-7: UDP SrcPort: 53 DestPort: 2544 

6 12:34:35 6/1 169143 ACL-7: UDP бгсРогі 53 DestPort: 2545 

6 12:34:35 9/2 169147 ACL-7: UDP SrcPort: 53 DestPort: 2546 

6 12:34:36 9/1 169156 ACL-7: UDP SrcPort: 53 DestPort: 2547 

6 12:34:37 6/2 169165 ACL-7: UDP  SrcPort: 53 DestPort: 2548 

6 12:34:38 6/1 169179 ACL-7: UDP SrcPort: 53 DestPort: 2549 

6 12:34:43 6/1 169254 ACL-7: 

6 12:34:46 6/1 169309 ACL-7: 

6 12:34:47 6/1 169349 ACL-7: 

6 12:34:49 6/1 169388 АСІ-7: 

6 12:35:19 6/1 170254 АСІ-7: МО ACL rule matchl Discarding packet 
6 12:35:50 6/1 171254 ACL-7: 

6 12:36:22 6/1 172254 ACL-7: 

6 12:36:31 6/1 172540 ACL-7: NO ACL rule match! Discarding packet 
6 12:36:31 6/1 172541 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 12:36:31 6/1 172542 ACL-7: 

6 12:36:31 6/1 172543 ACL-7: 

6 12:36:31 6/1 172544 АСІ.-7: 

6 12:36:31 6/1 172545 ACL-7: NO ACL rule match! Discarding packet 
6 12:36:31 6/1 172546 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 12:36:31 6/1 172547 ACL-T: 

6 12:36:31 6/1 172548 ACL-7: 

6 12:36:31 6/1 172549 ACL-T: 


6 12:36:54 6/2 173254 АСІ-7; ! Discarding packet 
6 12:37:43 6/1 174254 ACL-7 қ 
6 12:38:40 6/1 175254 ACL-7: UDP SrcPort: 137 DestPort: 137 


6 12:39:28 6/1 176254 ACL-7: NO ACL rule match! Discarding packet 
6 12:40:35 6/1 177254 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 12:43:01 6/1 178254 ACL-7: | 

6 12:44:13 6/1 179254 ACL-7: МО ACL rule match! Discarding packet 
6 12:47:54 9/2 180254 ACL-7: NO ACL rule match! Discarding packet 
6 12:48:59 6/1 181254 ACL-7: 

6 12:49:46 6/1 182254 ACL-7: 


6 12:50:01 6/1 182540 ACL-7: à DestPort: 137 
6 12:50:01 6/1 182541 ACL-7 
6 12:50:01 6/1 182542 ACL-7 


6 12:50:01 6/1 182543 ACL-7: 

6 12:50:01 6/1 182544 ACL-7: NO ACL rule match! Discarding packet 
6 12:50:01 6/1 182545 ACL-7; UD : 137 DestPort: 137 

6 12:50:01 6/1 182546 ACL- 

6 12:50:01 6/1 182547 ACL- 

6 12:50:01 6/1 182548 АСІ-7: 

6 12:50:01 6/1 182549 ACL-7: NO ACL rule match! Discarding packet 
6 12:51:38 6/1 183254 ACL-7: 
6 12:54:53 9/2 184254 ACL-7: 
6 12:57:54 6/1 185206 ACL-7: 
6 12:57:56 6/1 185221 ACL-7: 
6 12:57:57 6/1 185230 ACL-7: 
6 12:58:00 6/1 185254 ACL-7: 
6 13:01:11 6/1 186254 ACL-7: NO ACL rule match! Discarding packet 
6 13:01:55 6/1 187254 ACL-7: 

6 13:03:41 9/2 187689 ACL-7: UDP  SrcPort: 53 DestPort: 3254 

6 13:04:20 6/1 188254 ACL-7: NO ACL rule match! Discarding packet 
6 13:05:29 9/1 189254 ACL-7: 
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AUG 
AUG 
AUG 
AUG 
AUG 
AUG 


6 13:06:29 6/1 190254 ACL-7 


6 13:07:00 6/1 191254 ACL-7: 
6 13:08:02 6/1 192254 ACL-7: 
6 13:08:23 6/1 192540 ACL-7: 
6 13:08:23 6/1 192541 ACL-7: 
6 13:08:23 6/1 192542 ACL-7: 
6 13:08:23 6/1 192543 ACL-71 


6 13:08:23 6/1 192544 ACL-7: 
6 13:08:23 6/1 192545 ACL-7: 
6 13:08:23 6/1 192546 ACL-7; 
6 13:08:23 6/1 192547 ACL-7 
6 13:08:23 6/1 192548 ACL-7 
13:08:23 6/1 192549 ACL-7: 
3:08:31 6/1 192645 ACL-7 
3:08:32 6/1 192669 ACL-7 
3:08:34 6/1 192722 ACL-7: 
3:08:58 6/1 193031 ACL-7: 
6 13:09:00 6/1 193051 ACL-7: 
6 13:09:01 6/1 193066 ACL-7: 
6 13:09:04 6/1 193114 ACL-7: 
6 13:09:05 6/1 193124 ACL-7: 
6 13:09:05 6/1 193129 ACL-7 
6 13:09:06 6/1 193139 ACL-7: 
6 13:09:07 6/1 193153 ACL-7 
6 13:09:07 6/1 193158 ACL-7: 
6 13:09:07 6/1 193172 ACL-7 
6 13:09:08 6/1 193187 ACL-7: 
6 13:09:09 6/1 193192 ACL-7: 
6 13:09:11 6/1 193226 ACL-7: 
6 13:09:12 6/1 193236 ACL-7: 
6 13:09:12 6/1 193246 ACL-7: 
6 13:09:12 6/1 193251 ACL-7: 
6 13:09:13 6/1 193254 ACL-7: 
6 13:09:13 6/1 193256 ACL-7: 
6 13:09:13 6/1 193270 ACL-7: 
6 13:09:14 6/1 193280 ACL-7: 
6 13:09:14 6/1 193285 ACL-7: 
6 13:09:14 6/1 193290 ACL-7: 
6 13:09:15 6/1 193300 ACL-7: 
6 13:09:15 6/1 193305 ACL-7: 
6 13:09:15 6/1 193310 ACL-7: 
6 13:09:16 6/1 193319 ACL-7: 
6 13:09:17 6/1 193324 ACL-7: 
6 13:09:17 6/1 193329 ACL-7: 
6 13:09:17 6/1 193334 ACL-7: 
6 13:09:17 6/1 193339 ACL-7: 
6 13:09:18 6/1 193359 ACL-7: 
6 13:09:19 6/1 193364 ACL-7: 
6 13:09:19 6/1 193369 ACL-7: 
6 13:09:19 6/1 193374 ACL-7: 
6 13:09:20 6/1 193398 ACL-7: 
6 13:09:20 6/1 193403 ACL-7: 
6 13:09:20 6/1 193408 ACL-7: 
6 13:09:21 6/1 193428 ACL-7: 
6 13:09:22 6/1 193433 ACL-7: 
6 13:09:22 6/1 193438 ACL-7: 
6 13:09:22 6/1 193443 ACL-7: 
6 13:09:23 6/1 193453 ACL-7: 
6 13:09:24 6/1 193463 ACL-7: 
6 13:09:24 6/1 193473 ACL-7: 
6 13:09:25 6/1 193483 ACL-7: 
6 13:09:25 6/1 193488 ACL-7: 
6 13:09:25 6/1 193498 ACL-7: 
6 13:09:26 6/1 193517 ACL-7: 


6 
6 
6 
6 
6 


o‏ — نے کے 


Г —] 


NO ACL rule match! Discarding packet 
NO ACL rule match! Discarding packet 
UDP SrcPort: 137 DestPort: 137 


NO ACL rule match! rn p 


| 


NO ACL rule match! Discarding packet 
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AUG 
AUG 
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AUG 
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AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 
AUG 


6 13:09:27 6/1 193522 ACL-7 
6 13:09:27 6/1 193537 ACL-7 
6 13:09:28 6/1 193547 ACL-7 
6 13:09:28 6/1 193552 ACL-7 
6 13:09:28 6/1 193557 ACL-7 
6 13:09:29 6/1 193562 ACL-7 
6 13:09:29 6/1 193581 ACL-7 
6 13:09:30 6/1 193586 ACL-7 
6 13:09:30 6/1 193591 ACL-7 
6 13:09:30 6/1 193596 ACL-7 
6 13:09:31 6/1 193626 ACL-7 
6 13:09:32 6/1 193631 ACL-7 
6 13:09:33 6/1 193665 ACL-7 
13:10:16 8/1 194028 МЕТМАМ-6: 
13:10:21 8/1 194033 МЕТМАМ-6: 
13:11:29 6/1 194254 ACL-7 

13:13:05 6/1 195204 ACL-7 

13:13:06 6/1 195224 ACL-7 

13:13:08 6/1 195253 ACL-7 
13: 
13: 
13: 
1 


13:08 6/1 195254 ACL-7 

14:24 6/1 196254 ACL-7 

15:53 9/2 197254 ACL-7: UDP SrcPort: 53 DestPort: 3398 
3:18:27 6/1 198254 ACL-7: NO ACL rule match! Discarding packet 
6 13:19:37 6/1 199254 ACL-7: 
61320276/1200254àC.-7| ____ |] 
6 13:21:57 6/1 201254 ACL-7: 
6 13:22:31 6/1 202254 ACL-7: 
6 13:22:46 6/1 202540 ACL-7: 
6 13:22:47 6/1 202541 ACL-7: NO ACL rule match! Discarding packet 
6 13:22:47 6/1 202542 ACL-7: UDP  SrcPort: 137 DestPort: 137 
6 13:22:47 6/1 202543 ACL-7: 
6 13:22:47 6/1 202544 ACL-7: 
6 13:22:47 6/1 202545 ACL-7: 
6 13:22:47 6/1 202546 ACL-7: NO ACL rule match! Discarding packet 


6 13:22:47 6/1 202547 АСІ-7: : stPort: 137 
6 13:22:47 6/1 202548 ACL-7; 
6 13:22:47 6/1 202549 ACL-7; 


6 13:23:59 6/1 203254 ACL-7: 

6 13:25:54 6/1 204254 ACL-7: NO ACL rule match! Discarding packet 
6 13:26:16 6/1 205254 ACL-7 

6 13:26:47 6/1 206254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:27:18 6/1 207254 ACL-7: 

6 13:28:01 6/1 208254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:28:36 6/1 209254 ACL-7: 

6 13:29:19 6/1 210254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:30:46 6/1 211254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:32:04 6/2 212254 ACL- 

6 13:32:13 6/1 212540 ACL-7: 

6 13:32:13 6/1 212541 ACL-7: NO ACL rule match! Discarding packet 
6 13:32:13 6/1 212542 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:32:13 6/1 212543 ACL-7: 

6 13:32:13 6/1 212544 ACL-7: 
6 1 
6 1 
6 
6 


6 
6 
6 
6 
6 
6 
6 
6 
6 
6 


3:32:13 6/1 212545 ACL-7: 

3:32:13 6/1 212546 ACL-7: NO ACL rule match! Discarding packet 
13:32:13 6/1 212547 ACL-7: UDP  SrcPort; 137 DestPort: 137 
13:32:13 6/1 212548 ACL-7: 

6 13:32:13 6/1 212549 ACL-7: 

6 13:32:27 6/1 213254 ACL-7: 

6 13:32:49 6/1 214254 ACL-7: 

6 13:33:15 6/1 215254 ACL-7: NO ACL rule match! Discarding packet 
6 13:34:14 6/1 218254 ACL-7: NO ACL rule match! Discarding packet 
6 13:34:31 6/1 219254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:34:57 6/1 220254 ACL-T: 


6 13:36:14 6/2 221254 АС] 
e I 


6 13:37:36 6/1 222254 ACL-7: 
6 13:37:46 6/1 222540 ACL-7: 
6 13:37:46 6/1 222541 ACL-7: 
6 13:37:46 6/1 222542 ACL-7: 
6 13:37:46 6/1 222543 ACL-7: NO ACL rule matchi Discarding packet 
6 13:37:46 6/1 222544 ACL-7: : 137 

6 13:37:46 6/1 222545 ACL- 
6 13:37:46 6/1 222546 ACL- 
6 13:37:46 6/1 222547 ACL-7: 
6 13:37:46 9/1 222548 ACL-7: NO ACL rule match! Discarding packet 
6 13:37:46 9/1 222549 ACL-7: UDP SrcPort: 24603 DestPort: 137 

6 13:38:33 9/2 225400 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:33 9/2 225404 ACL-7; : 4006 

6 13:38:33 9/2 225409 ACL- 
6 13:38:33 9/2 225410 ACL- 
6 13:38:33 6/1 225411 ACL-7: rule match! Discarding packet 
6 13:38:33 6/1 225412 ACL-7: UDP SrcPort; 137 DestPort: 137 

6 13:38:33 6/1 225414 ACL-7: 

6 13:38:33 6/1 225415 ACL-7: 

6 13:38:33 6/1 225416 ACL-7: 

6 13:38:33 6/1 225417 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:33 6/1 225419 ACL-7: ort: 137 

6 13:38:33 6/1 225428 ACL-7: 

6 13:38:33 6/1 225429 ACL-7: 

6 13:38:33 6/1 225430 ACL-7: 

6 13:38:33 6/1 225431 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:33 6/1 225432 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:38:33 6/1 225433 ACL-7 

6 13:38:33 6/1 225434 ACL-7 

6 13:38:33 6/1 225435 ACL-7: 

6 13:38:33 6/1 225436 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:33 6/1 225437 ACL-7: UD : 137 DestPort: 137 
6 13:38:33 6/1 225438 ACL-7: 
6 13:38:33 6/1 225439 ACL-7: 


6 13:38:33 6/1 225440 ACL-T: 

6 13:38:33 6/1 225441 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:33 6/1 225442 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 13:38:34 6/1 225452 ACL-7: 

6 13:38:34 6/1 225453 ACL-T: 

6 13:38:34 6/1 225457 ACL-7: 

6 13:38:34 6/1 225458 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:34 6/1 225459 ACL-7 UDP  SrcPort: 137 DestPort: 137 

6 13:38:34 6/1 225460 ACL-7 

6 13:38:34 6/1 225461 ACL-7 

6 13:38:34 6/1 225462 ACL-7* 

6 13:38:34 6/1 225463 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:34 6/1 225464 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 13:38:34 6/1 225465 ACL- 

6 13:38:34 6/1 225466 ACL- 

6 13:38:34 6/1 225467 ACL-7: 

6 13:38:34 6/1 225468 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:34 6/1 225469 ACL-7: rt: 137 
6 13:38:34 6/1 225470 ACL-7: 
6 13:38:34 6/1 225471 ACL-7: 


6 13:38:34 6/1 225472 ACL-7: 
6 13:38:34 6/1 225473 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:34 6/1 225474 АСІ-7; : 137 
6 13:38:34 6/1 225475 ACL-7 
6 13:38:34 6/1 225476 ACL-7 
6 13:38:34 6/1 225477 ACL-7: 


6 13:38:34 6/1 225478 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:34 6/1 225479 ACL-T: ort: 137 
6 13:38:34 6/1 225480 ACL-7: 
6 13:38:34 6/1 225481 ACL-7: 
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6 13:38:34 6/1 225482 ACL-7: 
6 13:38:34 6/1 225483 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:34 6/1 225484 ACL-7: UDP ; 137 DestPort: 137 
6 13:38:34 6/1 225485 ACL-7: 
6 13:38:35 6/1 225486 ACL-7: 


6 13:38:35 6/1 225487 ACL-7: 
6 13:38:35 6/1 225488 ACL-7: NO ACL rule match! Discarding packet 


6 13:38:35 6/1 225489 ACL-7: ort: 137 
6 13:38:35 6/1 225490 ACL-7: 
6 13:38:35 6/1 225491 ACL-7: 


6 13:38:35 6/1 225492 ACL-7: 
6 13:38:35 6/1 225493 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:35 6/1 225494 ACL-7: UDP  SrcPort: 137 DestPort: 137 
6 13:38:35 6/1 225495 ACL-7 
6 13:38:35 6/1 225496 ACL-7 
6 13:38:35 6/1 225497 ACL-7: 
6 13:38:35 6/1 225498 ACL-7: NO ACL rule match! Discarding packet 
6 13:38:35 6/1 225499 ACL-7: UDP SrcPort: 137 DestPort: 137 
6 13:38:53 6/1 226254 ACL-7; NO ACL rule match! Discarding packet 
6 13:39:10 6/1 227254 ACL-7L. — — |] 
6 13:39:41 6/1 228254 ACL-7: UDP  SrcPort: 137 DestPort: 137 
6 13:40:12 6/1 229254 ACL-7 
6 13:40:56 6/1 230254 ACL-7: NO ACL rule match! Discarding packet 
6 13:41:45 6/1 231254 ACL- 
6 13:43:22 6/1 232254 ACL- 
6 13:43:40 6/1 232540 ACL-7: UDP SrcPort: 137 DestPort: 137 
6 13:43:40 6/1 232541 ACL-7 
6 13:43:40 6/1 232542 ACL-7 
6 13:43:40 6/1 232543 ACL-7: 
6 13:43:40 9/1 232544 ACL-7: NO ACL rule match! Discarding packet 
6 13:43:41 9/1 232545 ACL-7: : rt: 4207 
6 13:43:41 9/1 232546 ACL-7: 
6 13:43:41 9/1 232547 ACL-7: 
6 13:43:41 6/1 232548 ACL-7: NO ACL rule maich! Discarding packet 
6 13:43:41 6/1 232549 ACL-7: UDP SrcPort: 137 DestPort: 137 
6 13:44:27 9/2 233177 АСІ-7; :4254 
6 13:44:31 6/1 233254 ACL-7 
6 13:45:02 6/1 233641 ACL-7 
6 13:45:03 6/1 233655 ACL-7 
6 13:45:05 6/1 233677 ACL-7 
6 13:46:51 6/1 234254 ACL-7 
6 13:48:17 6/1 235254 ACL-7 
6 13:49:04 6/1 236254 ACL-7 
6 13:49:55 6/1 237254 ACL-T: 
6 13:50:31 6/1 238254 ACL-7: NO ACL rule match! Discarding packet 
6 13:51:03 6/1 239254 ACL-7: 
13:52:14 9/2 240254 ACL-7: 
3:53:10 6/1 241254 ACL-7: 
3:54:56 9/1 242254 ACL-7: UDP  SrcPort: 1035 DestPort: 137 
3:55:05 9/1 242540 ACL-7: 
3:55:05 9/1 242541 ACL-7: 
3:55:05 9/1 242542 ACL-7: NO ACL rule match! Discarding packet 


3:55:06 9/1 242543 ACL-7: ort: 137 
3:55:06 9/1 242544 ACL-T: 
3:55:06 9/1 242545 ACL-7: 


1 

1 

1 

1 

1 

1 

1 

1 

13:55:06 9/1 242546 ACL-T: 
13:55:06 9/1 242547 ACL-7: NO ACL rule match! Discarding packet 
13:55:06 9/1 242548 ACL-7: UDP  SrcPort: 1035 DestPort: 137 
13:55:06 9/1 242549 ACL-7: 
13:55:47 6/2 243254 ACL-7: 
13:56:55 9/2 244254 ACL-7: 
13:57:47 6/1 245254 ACL-7: 
13:58:36 9/1 246254 ACL-7: UDP  SrcPort: 1035 DestPort: 137 
14:00:44 6/1 248254 ACL-7: UDP  SrcPort: 137 DestPort: 137 
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6 14:01:36 6/1 249254 ACL-7: 

6 14:02:24 6/1 250254 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 14:02:57 6/1 251254 ACL-7: 

6 14:03:35 6/1 252540 ACL-7: NO ACL rule match! Discarding packet 


6 14:03:35 6/1 252541 ACL-7; : 137 

6 14:03:35 6/1 252542 ACL-7 

6 14:03:35 6/1 252543 ACL-7 

6 14:03:35 6/1 252544 ACL-7: 

6 14:03:35 6/1 252545 АСІ.-7; 1 Discarding packet 
6 14:03:50 6/1 253254 ^C ا‎ 

6 14:04:11 6/1 254000 ACL-7: ACL rule match! Discarding packet 
6 14:04:11 6/1 254001 АСІ-7; a rt: 137 

6 14:04:11 6/1 254002 ACL-7 

6 14:04:11 6/1 254003 ACL-7 

6 14:04:11 6/1 254004 ACL-7: 


6 14:04:11 6/1 254005 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:11 6/1 254006 ACL-7; ; 137 
6 14:04:11 6/1 254007 ACL-7 
6 14:04:11 6/1 254008 ACL-7 


6 14:04:11 6/1 254009 ACL-7: 

6 14:04:11 6/1 254010 ACL-7: NO ACL rule match! Discarding packet 
6 14:04:11 6/1 254011 ACL-7; DestPort: 137 

6 14:04:11 6/1 254012 ACL- 
6 14:04:11 6/1 254013 ACL- 
6 14:04:11 6/1 254014 ACL-7: 
6 14:04:11 6/1 254015 ACL-7: NO ACL rule match! Discarding packet 
6 14:04:11 6/1 254016 ACL-7: UDP  SrcPort: 137 DestPort: 137 

6 14:04:11 6/1 254017 ACL-7: 

6 14:04:11 6/1 254018 ACL-7: 

6 14:04:11 6/1 254019 ACL-7: 

6 14:04:11 6/1 254020 ACL-7: NO ACL rule match! Discarding packet 
6 14:04:11 6/1 254023 ACL-7: UDP SrcPort: 137 DestPort: 137 

6 14:04:11 6/1 254024 ACL-7 

6 14:04:11 6/1 254025 ACL-7 

6 14:04:11 6/1 254026 ACL-7: 

6 14:04:11 9/1 254027 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:11 9/1 254028 АСІ-7; : 1035 DestPort: 137 
6 14:04:11 9/1 254029 ACL-7 
6 14:04:11 9/1 254030 ACL-7 


6 14:04:11 9/1 254031 ACL-7: 

6 14:04:11 6/2 254032 ACL-7: NO ACL rule match! Discarding packet 
6 14:04:12 6/2 254033 ACL-7: қ tPort: 4904 

6 14:04:12 6/2 254034 ACL-7: 

6 14:04:12 6/2 254035 ACL-7: 

6 14:04:12 6/1 254036 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:12 6/1 254037 ACL-7: : 137 
6 14:04:12 6/1 254038 ACL-7 
6 14:04:12 6/1 254039 ACL-7 


6 14:04:12 6/1 254040 ACL-7: 
6 14:04:12 9/1 254041 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:12 9/1 254042 ACL-7: rt: 137 

6 14:04:12 9/1 254043 ACL-7: 

6 14:04:12 9/1 254044 ACL-7: 

6 14:04:12 9/1 254045 ACL-7: 

6 14:04:12 9/1 254046 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:12 9/1 254047 ACL-7: rt: 137 
6 14:04:12 9/1 254048 ACL-7: 
6 14:04:12 9/1 254049 ACL-7: 


6 14:04:12 9/1 254057 ACL-7: 
6 14:04:12 6/1 254062 ACL-7: NO ACL rule match! Discarding packet 
6 14:04:12 6/1 254063 ACL-7: NO ACL rule match! Discarding packet 


6 14:04:12 6/1 254064 ACL-7: rt: 137 
6 14:04:12 6/1 254067 ACL-7: 
6 14:04:12 6/1 254072 ACL-7: 


e I 


AUG 6 14:04:12 6/1 254073 ACL-7: 

AUG 6 14:04:12 6/1 254077 ACL-7: NO ACL rule match! Discarding packet 
AUG 6 14:04:12 6/1 254078 ACL-7: ‚53 DestPort: 4905 
AUG 6 14:04:12 6/1 254079 ACL-7: 

AUG 6 14:04:12 6/1 254080 ACL-7; 

AUG 6 14:04:12 6/1 254082 ACL-7: NO ACL rule match! Discarding packet 
AUG 6 14:04:12 6/1 254083 ACL-7: UDP  SrcPort: 137 DestPort: 137 
AUG 6 14:04:13 6/1 254084 ACL-7 

AUG 6 14:04:13 6/1 254085 ACL-7 

AUG 6 14:04:13 6/1 254086 ACL-7: 

AUG 6 14:38:23 8/1 254087 NETMAN-6: Session logged out due to idle 


AUG 614:38248/1254088NETMAN-|. J] 
AUG 6 14:49:53 8/1 254089 NETMAN-2: Enterprise:Service Transition: W S1 
AUG 6 14:49:53 8/1 254090 NETMAN-2: Enterprise:Service Transition: WSS31 


AUG 6 14:50:03 8/1 254091 МЕТМАМ-5: Enterprise:Service Transition WSSS1 


AUG 6 14:50:04 8/1 254092 NETMAN-S: Enterprise:Service Transition: WS1 


alive 

AUG 6 14:50:10 8/1 254093 NEMAN wm 
AUG 6 14:50:48 8/1 254094 NETMAN-2: Enterprise:Service Transition: 

-> 

down 


AUG 6 14:50:48 8/1 254095 NETMAN-2: Enterprise:Service Transition:WSSS1 
-> 
down 


AUG 6 14:52:11 8/1 254096 NETMAN-6] |] 


W 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: С bstesmin.com 


Sent: Th 000 1:14 PM 
To: 
Subject: Me being asking for the info to who owns it 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 

00000000 

Message-ID: 

ГГ Jsitesmith.com> 
Date: 

Fri, 04 Aug 2000 16:56:36 -0400 


Fri 
ا‎ — өй 


X-Mailer: 
Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 


en 
MIME-Version: 
1.0 


[  J]Qgnav-international.com» 


Subject: 
Re: Is this a real email address?? 
References: 


а — YVWMUÜIAIIÇIAMAIbD:spn3spr.nəvistarcom> 
ontent- Type: 


text/plain; charsetzus-ascii 
Content-Transfer-Encoding: 
Tbit 


The site that was hacked was siscom.net, the reason l link you to 
itis becaus to a hacker, which means you must 


have his info. 


> 


> You can link me to bind | |] because i am.. 


> 


> How you can link me to the compromised site, i have no clue. | dont 
7 know which site is being hacked or was hacked. 


Gees Она Ж) 
> From: sitesmith.com] 

> Sent: Friday, August 04, 2000 1:58 PM 

> To: 

> Subject: Re: Is this a real email address?? 

> 

> Well, it would be nice to know why I was able to link your name to 

> both 

> the compromised site (which 1 can confirm is compromised....ftp in as 


e i e 


b7C 


| 
| 


> anonymous and tell me what you see) and] 


> 
ÎÛ rote: 
> 

>> 

>> 


> > Oh.. i see, If there is anything you need from me, let me know. 
>> 


> > From @sitesmith.com] 
> > бер Eri 04, 2000 1:44 PM 

>>To 

> > Subject: Re: Is this a real email address?? 

>> 


> > uh, yeah except the motherfucker is hacking my site. 
>> 


>>> 
> > > correct.. | just [ þomanaur.com, whatever content is on 
> the 

>> 

> > > page is his own fault.. 

>>> 

> > > afaik iscom.net == comandur.com.. so nothing unusual is 
> going 

>> 

> > > on here. 

>>> 


> > > From: @sitesmith.com] 

> > > Sent: Friday, August 04, 2000 1:29 PM 

> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Sorry to leave you in the dark. comandur.com IS the hacker, and 

> you 

>> 

>>ЦП ^ т. So may need some help from you. The victim 
> is 

>> 


> > > siscom.net ..... check out tomr.siscom.net 
>>> 


>>> 

>>> > 

>> >> 

> > > > Okay, everything was going good for my day, then you mention 
> > this.. 

>>>> 

> > > >... then withhold details, like "One of the 350 websites you 

> host 

> > > was 

> > > > hacked" 

> >>> 

> > > > eluding to 1115.net as the site that was hacked.. but yet i can 
> > find 

>>> 

> > > > по signs anywhere... 

>>>> 

> > > > If you would be so kind, please email me a link to a hacked 


> page, 
e 25 


> > so 


>>> 
-> > > > some other proof.. This is driving me crazy. 
>>>> 
> > > > 
>>> 
>>> 


> > > > Navistar International 
>> >> 


> > > > From: sitesmith.com] 
> > > > бер Еп t 04, 2000 12:45 PM 
>>> > То 


> > > > Subject: Re: Is this a real email address?? 
>>>> 


>>>>Asiteyo[ ^ јогмаѕ hacked... 


> > > > 
>> >> 
>>>>> 
>>>>> 


> > > > > which site was hacked? апа what makes you think it was hacked? 


> 

>>>>> 

> > > > > س‎ Original Message----- 

> > > > > From itesmith.com] 
> > > > > беги Eri st 04, 2000 12:18 PM 

>> >>> То: 

> > > > > Subject: Re: Is this a real email address?? 

>>>>> 

> > > > > Apparently you didn't understand my response. Your email is 
> > > > plastered 

> > > > > all over a website that was hacked, and more importantly, you 


>> 
لاد 

>>> 

> > > > > for 

> > > > > this hacked website. 

>> >>> 

>> >>> 

>>>>>> 

>>>>>> 

> > > > > > what makes you think that? 

>>>>>> 

> > > > > > ----- Original Messade---- 

> > > > > > From itesmith.com] 
> > > > > > Sent: Friday, August 04, 2000 11:19 AM 

> > > > > > Subject: Re: Ts this a real email address?? 
>>>>>> 

> > > > > > Actually, | would like to be even more specific...... | got 
> > your 

>>> 

> > > > > email 

>>>>>> 


> > > > > > address from а hacked website. 
> > > > > > 


>>>>> 


>>>>>>> 
>>>>>>> 
> > > > > > > Yes | do... get my email address from whois information? 
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>>>>>>> 
>>>>>>>-----Огісіпгі Меѕѕаае----- 


> > > > > > > From itesmith.com] 
> > > > > > > Sent: Friday, August 04, 2000 10:59 AM 


> > > > > > > Subject: Re: Is this a real email address?? 


>>>>>>> 

> > > > > > > Let me ask you something.... .do you have any affiliation 
> > with 

>>> 

> > > > > > > 1115.net? 

>>> > >>> 

>> >> >>> 

>>>>>>>> 

>>>>>>>> 


> > > > > > > > This HAS to ре the weirdest email І have had in a while. 


> 
>>>>>>>> 


> > > > > > > > ----- Original Message----- 

255542. ваті соп) 
> > > > > > > > Sent: Friday, August 04, : 

5225525 -ы i ae 


> > > > > > > > Subject: Is this а real email address?? 
>>> >> >>> 


>>> >> >>> If this is a real address please respond... 
>>>>>>>> 

>>>>>>>>-- 

>>>>>>>> 


>>>>>>> 
>>>>>>> 
>>>>>>> 


> > > > > > > > www.sitesmith.com 
> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 


>>>>>>> 
>>>>>>>-- 
>>>>>>> 
> > > > > > >, 


>>>>>> 
>>>>>> 
> > > > > > > www.sitesmitn.com 


> > > > > > > "We are the master Internet Craftsmen" 
> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 

>>>>>> 

> >> > > > -- 

>>>>>> 


>>>>>> 
>>>>>> 
>>>>>> 
> > > > > > www.sllesmitn.com 


> > > > > > "We are the master Internet Craftsmen" 
> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 

>>>>> 

>>>>>-- 

>>>>> 


>>>>> 


>>>> 
>>>> 
> > > > > www.sitesmitn.com 


> > > > > "We are the master Internet Craftsmen" 
> > > > > Customer Care Center (888) 898 7667 
>> >>> 

>>>> 

> > > > -- 

>>>> 

>>>> 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>> >> 

>>> 

> > > -- 

>>> 

>>> 


>> 
>> 
> > > www.sitesmith.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
> > = 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

Sco 

> 


>"We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


NES Е 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


m " 


"We are the master Internet Craftsmen" 


Customer Care Center (888) 898 7667 
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From: itesmith.com] 
Sent: Thursday, August 17, 2000 1:13 PM 

To: 

Subject: Me answerin original question from before 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Messa : 
itesmith.com> 


Date: 
Fri, 04 Aug 2000 16:54:26 -0400 


Fri 
X-Mailer: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 


[ т 


Subject: 
Re: Is this a real email address?? 
References: 


фос sprnavistar com 
ontent- Гуре: 


text/plain; charset-us-ascii 
Content-Transfer-Encoding: 
Tbit 


tomr.siscom.net 


» Fro sitesmith.com] 


> Sent: Friday, August 04, 2000 1:58 PM 
s roo] 


> Subject: Re: Is this a real email address?? 
> 


> Well, it would be nice to know why I was able to link your name to 
> both 


> the compromised site (which | can confirm is compromised....ftp in as 
> anonymous and tell me what you see) and you being J. “v j] 
> 


> 


>> 


@ š 


>> 
> > Oh.. i see, If there is anything you need from me, let me know. 


bic 


> > ----- Original Message-—-- 

> > From: sitesmith.com] 
> > Sent: Friday, August 04, 2000 1:44 PM 
г ч 

> > Subject: Re: Is this a real email address?? 

>> 


> > uh, yeah except the motherfucker is hacking my site. 
>> 


>> 

>>> 

>>> 

> > > correct.. | js[ ^ ]eomanaur.com, whatever content is on 
> the 

>> 

> > > page is his own fault.. 

>>> 

> > > afaik | Eiscom.net == comandur.com.. so nothing unusual is 
> going 

>> 

> > > on here. 

>>> 


> > > From itesmith.com] 


> > > Sept: Fri 4, 2000 1:29 PM 
>>> То 
> > > Subject: Ке: 1S this a real email address?? 


>>> 

> > > Sorry to leave you in the dark. comandur.com IS the hacker, and 

> you 

>> 

>> lL For him. So | may need some help from you. The victim 
> is 

>> 


> > > siscom.net ..... check o[ ]siscom.net 
>>> 


>>> 

>>>> 

>>>> 

> > > > Okay, everything was going good for my day, then you mention 
> > this.. 

>>> > . 

> > > > ... then withhold details, like "One of the 350 websites you 
> host 

> > > was 

> > > > hacked" 

>> >> 

> > > > eluding to 1115.net as the site that was hacked.. but yet i can 
> > find 

>>> 

> > > > no signs anywhere... 

>> >> 

> > > > If you would be so kind, please email me a link to a hacked 
> page, 

> > so 

>>> 

> > > > some other proof.. This is driving me crazy. 

>>> > 


> > > > 
>>> 
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> > > > NT support 

> > > > Navistar International 

>>>> 

> > > > ----- Original Message----- 

> > > > From: sitesmith.com] 
> > > > Sent: Friday, August 04, 2000 12:45 PM 

>> >> То 


> > > > Subject: Re: Is this a real email address?? 
>>> > 


> > > > A site уШЦ фо was hacked.... 
>> >> 

>> >> 

>> >>> 

>>> >> 


> > > > > which site was hacked? and what makes you think it was hacked? 


> > > > > From itesmith.com] 


> > > > > Subject: Re: [s this a real email address?? 

>> >>> 

> > > > > Apparently you didn't understand my response. Your email is 
> > > > plastered 

> > > > > all over a website that was hacked, and more importantly, you 


>> 

>> 

> >>> 

> > > > > for 


> > > > > this hacked website. 
>>>>> 


эээЦ: ote: 
>>> >> 

>>>>>> 

>>>>>> 


> > > > > > what makes you think that? 
>>>>>> 


>>>>>> 
> > > > > > Actually, | would like to be even more specific...... | got 
> > your 

>>> 

> > > > > email 

>>>>>> 


> > > > > > address from а hacked website. 
>>>>>> 


>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > Yes | do... get my email address from whois information? 
>>>>>>> 

| > > > > > > > шш. Original Меѕѕаае----- 

> > > > > > > From sitesmith.com] 


> > > > > > > беги Ец t 04, 2000 10:59 AM 
> > > > > > > To: 


> > > > > > > Subject: Re: Is this a real email address?? 
>>>>>>> 

> > > > > > > Let me ask you something.... .do you have any affiliation 
> > with 

>>> 

> > > > > > > 1115.net? 

>> >> >>> 

>>>>>>> 

>>>>>>>> 

>>>>>>>> 


> > > > > > > > This HAS to be the weirdest email | һауе had in a while. 


> 
>>>>>>>> 


> > > > > > > > ----- Orjai 
> > > > > > > > Sent: Frida: ugust 04, 2000 2:10 AM 


>>> > > >>> To avistar.com 

> > > > > > > > Subject: 15 this a real email address?? 
>>>>>>>> 

>>>>>>>> If this is a real address please respond... 
>>>>>>>> 

>>>>>>>>-. 

>>>>>>>> 


>>>>»>»>»>»>» 20207. 
>>>>>>>> 

>>>>>>>> 

> > > > > > > > www.sitesmith.com 


> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 


>>>>>>> 

>>>>>>>-- 

>>>>>>> 

>>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 


> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
>>>>>>-- 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 


>> >>> 

> > > > > -- 

>>>>> 

>>>> 

>>> > 

>>> >р 

> >>> р 2 E 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


>>>> 
>>>>-- 


bic 


> >>> 
> >>> 


>>> 
>>> 
> > > > www.sitesmiin.com 


> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>> > 


>>> 
>>>-- 

>>> 

>> 

>> 

>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

> > 

> > 

> 

> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
зды 
> 
> 


news, 


> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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— ———— HOÉBMÜ— 


From: [— — — Безтікоот) bé 
Sent: Thursday, August 17, 2000 1:12 PM bC 
To: 

Subject: — " stupid 

X-Sieve: 


cmu-sieve 1.3 


1, 
С —  hav-international. com> 


Received: 


ШЕШЕЙ Ы com (mail.navistar.com 
by mailbox. EN... com J ГЫШ. 
ESMTPi EE for 


com>; Fri, 4 Aug 2000 12:26:36 -0700‏ .| ا 


— 
from 


itesmith.com; Fri, 4 Aug 2000 14:28:18 CST 


Received: 


navistar.com with Internet Mail Service 
id Fri, 04 Aug 
2000 14:28:18 -0500 
Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 14:28:14 -0500 
From: 


Е  —havrnernationalcom> 


Subject: 
RE: Is this a real email address?? 


To: 


[ —  — — —biesmith.com» 


Message-ID: 
prxspn3.spr.navistar.com> 


MIME-version: 
1.0 


X-Mailer: 
Internet Mail Service (| 
Content-type: 
multipart/alternative; 
boundary-"-—-- = МехіРаг 001 O1BFFE4A.220A2B30" 
X-Mozilla-Status: 
8011 
X-Mozilla-Status2: 
00000000 


Ива 


| wont be able to respond to this email address until monday, if you 
need something in the meantime, please feel free to reach me at 
1115.net 


35 


----- Oriqinal Меѕѕаае----- 
5 Нн = ГҮҮ 
Sent: Fri 2 zz , 2000 1:58 PM 


To 
Subject: Re: Is this a real email address?? 


Well, it would be nice to know why | was able to link your name to both 
the compromised site (which | can confirm is compromised....ftp in as 
anonymous and tell me what you see) and you being у= 
[ — uote: 


> 
> 


> Oh.. i see, If there is anything you need from me, let me know. 


> ----- Original Message----- 

> From itesmith.com] 
> Sent: Eri t 04, 2000 1:44 PM 

>To 


> Subject: Re: Is this a real email address?? 
> 


> uh, yeah except the motherfucker is hacking my site. 
> 


> 
>> 
>> 


> > correct.. just | comandur.com, whatever content is on the 


> 
> > page is his own fault.. 


>> 
>> afak[  Eiscom.net == comandur.com.. so nothing unusual is going 


> 
> > on here. 


> > From itesmith.com] 
> > Sent=Eri 04, 2000 1:29 PM 
>> To: 


> > Subject: Re: Is this a real email address?? 
>> 


> > Sorry to leave you in the dark. comandur.com IS the hacker, and you 


> 
>> [ him. So | may need some help from you. The victim is 


> 
> > siscom.net ..... check out tomr.siscom.net 


>> 


>>> 


> > > Okay, everything was going good for my day, then you mention 
> this.. 

>>> 

> > > ... then withhold details, like "One of the 350 websites you host 
> > was 

> > > hacked" 


>>> 


> > > eluding to 1115.net as the site that was hacked.. but yet i сап 

> find 

>> 

> > > no signs anywhere... 

>>> 

> > > If you would be so kind, please email me a link to a hacked page, 
> so 


>> 

> > > some other proof.. This is driving me crazy. 

>>> 

> > > Thank You 

>>> 

>>> 

> > > Navistar International 

>>> 

> > > ----- Original Message----- 

> > > From: sitesmith.com] 


> > > Sent: Friday, August 04, 2000 12:45 PM 
ог 


> > > Subject: Re: Is this а real email address?? 
>>> 


> > > А site you [for was hacked.... 
>>> 


>>> 
> >>> 

>>>> 

> > > > which site was hacked? and what makes you think it was hacked? 
> >>> 

> > > > ----- Original Messaqe----- 


> > > > From: sitesmith.com] 
> > > > Sent: Eriday, August 04, 2000 12:18 PM 

> > > > Subject: Re: Is this a real email address?? 

>>>> 


> > > > Apparently you didn't understand ту response. Your email is 
> > > plastered | 
> > > > all over а website that was hacked, and more importantly, you[ | 


> 
>> 

>>> 

> > > > for 

> > > > this hacked website. 
>> >> 

»»» wrote: 
>> >> 

>> >>> 

>>>>> 


> > > > > what makes you think that? 
>>>>> 


> > > >> To 

> > > > > Subject: Re: Is this a real email address?? 

>>>>> 

> > > > > Actually, | would like to be even more specific...... | got 
> your 

>> 

> > > > email 

>>>>> 

> > > > > address from a hacked website. 
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~l OF 


>>> >> 
46444 wrote: 
>>> >> 
>>> >>> 
>>>>>> 


> > > > > > Yes | do... get my email address from whois information? 
>>>>>> 


> > > > > > From: 
> > > > > > Sent: 
>> >> > > To: 
> > > > > > Subject: Re: 15 this a real email address?? 

>P>> >>> 

> > > > > > Let me ask you something.... .do you have any affiliation 
> with 

>> 

> > > > > > 1115.net? 


>>>>>> 

-эээээГ wrote: 

>>>>>> 

>> >>>>> 

>>>>>>> 

> > > > > > > This HAS to be the weirdest email | have had in a while. 
>> >>>>> 


>>>>>>> Тар  fevistar.com 
> > > > > > > Subject: Is this a real email address?? 


>>>>>>> 

>>>>>>> If this is а real address please respond... 
>>>>>>> 

>>>>>>>-- 

>>>>>>> 

>>>>>> 

>>>>>> 


.>>>>>> 


> > > > > > > WWW-.sitesmiln.com 
> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
>>>>>>-- 

>>>>>> 

>>>>> 

>>>>> 

>>> > > 

> > > > > > WWW.SITesmit.Com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 


>>>>> 
> > > > > -- 

>>>>> 

>>>> 

>>>> 

>>>> 

> > > > > www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 


>>>> 
>>>>-- 
>>>> 
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> > > > 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>>>> 

>>> 

>>>. 

>>> 

>> 
>> 
>> 
> > > www.sitesmith.com 

> > > "We аге the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 


J | 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


БИШ i 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


b6 
b7C 
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From: sitesmith.com] 

Sent: 1:10 PM 

To: b6 
Subject: EALLY knows how to play stupid b7C 
X-Sieve: 


cmu-sieve 1.3 


Return- З . 
@nav-international.com> 


Received: 


fo Jnavistar.com (mail.navistar.com 


С] by mailbox.sitesmith.com (Postfix) 
i for 
itesmith.com>; Fri, 4 Aug 2000 11:15:37 -0700 
(PDT) 
Received: 
() 


ру navistar.com (PMDF 
L with ESMTP id 
| . A Bnavistar.com» for 
|  [sitesmith.com; Fri, 4 Aug 2000 13:17:15 CST 
Received: 
b avistar.com with Internet Mail Service 
id Fri, 04 
Aug 2000 13:17:15 -0500 
Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 13:17:12 -0500 


Fri _ 
CE 


Subject: 
RE: Is this a real email address?? 


вао» 


Message-ID: 


[x= rt pnt com> 
-Version: 


1.0 
X-Mailer: 
Internet Mail Sevcd | 
Content-type: 
multipart/alternative; 
boundary="----_= NextPart 001 O1BFFE40.35D448D0" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


You can link me to being hiss | because i am.. 


How you can link me to the compromised site, i have no clue. | dont know 
which site is being hacked or was hacked. 


e i ө 


From itesmith.com] 


Subject: Re: Is a real email address?? 


Well, it would be nice to know why I was able to link your name to both 
the compromised site (which І can confirm is compromised....ftp in as 
anonymous and tell me what you see) and you being ڪڪ‎ 


> 
> 


> Oh.. i see, If there is anything you need from me, let me know. 


> ----- Original Меѕѕаде----- 

> From: Kevin McConnell. ^ ^ ]gsitesmith.com] 
> Sent: Friday, August 04, 2000 1:44 PM 

> То: 

> Subject: Ке: Is this а real етай address?? 

> 


> uh, yeah except the motherfucker is hacking my site. 
> 


>> 
>> 


> > correct.. lu[ — отапаш-сот, whatever content is on the 


> 
> > page is his own fault.. 


>> 
>> afaik| þiscom.net == comandur.com.. so nothing unusual is going 


> 
> > on here. 

>> 

> < Original Messade----- 

> > From sitesmith.com] 
> > Sent: Friday, August 04, 2000 1:29 PM 

> > Subject: Re: 15 this a real email address?? 

>> 


> > Sorry to leave you in the dark. comandur.com IS the hacker, and you 


> 
> f Дт. So | may need some help from you. The victim is 


> 


> > siscom.net ..... check out tomr.siscom.net 
>> 


>> 

>>> 

>>> 

> > > Okay, everything was going good for my day, then you mention 
> this.. 

>>> 


>>> .., then withhold details, like "One of the 350 websites you host 


> > was 
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> > > hacked" 

>>> 

> > > eluding to 1115.net as the site that was hacked.. but yet i can 
> find 

>> 

> > > no signs anywhere... 

>>> 

> > > |f you would be so kind, please email me a link to a hacked page, 
> SO 

>> 

> > > some other proof.. This is driving me crazy. 

>>> 

>>> 

>> 

>> 

> > > Navistar International 

>>> 


> > > From: sitesmith.com] 
> > > Sent Friday, August 04, 2000 12:45 PM 
> > > T 


> > > Subject: Re: Is this a real email address?? 
>>> 


> > > A site you Сы was hacked.... 


> > > 


>> 


>>>> 
>>>> 


> > > > which site was hacked? and what makes you think it was hacked? 
>> >> 


>>> > To: 

> > > > Subject: Re: Is this a real email address?? 

>>>> 

> > > > Apparently you didn't understand my response. Your email is 

> > > plastered 

> > > > all over a website that was hacked, and more importantly, ЛЕН 


> 

SE 

>>> 

- > > > > for 

> > > > this hacked website. 


> > > >| 
> > > >! 


>>>>> 
>>>>> 

> > > > > what makes you think that? 

>> >>> 

> > > > >-----Original Меѕѕаае----- 

> > > > > From: itesmith.com] 
> > > > > Sent: Friday, August 04, 2000 11:19 AM 

> > > > > To: 

> > > > > Subject: Re: Is this a real email address?? 

>>> >> 

> > > > > Actually, ! would like to be even more specific...... | got 

> your 

>> 

> > > > email 

>>>>> 
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b6 
b7C 


> > > > > address from a hacked website. 
> > > > > 


>> >>> 
>>>>>> 
>>>>>> 


> > > > > > Yes | do... get my email address from whois information? 
>>> >>> 


>>>>>>T 

> > > > > > Subject: Re: Is this a real email address?? 

>>>>>> 

> > > > > > Let me ask you something.... .do you have any affiliation 
> with 

>> 

>>>>>>1115.net? 


>>>>> 
2222» wrote: 

>> >>> > 

>>>>>>> 

>>>>>>> 

> > > > > > > This HAS to be the weirdest email | have had їп а while. 
>P> >> >>> 

> > > > > > > ----- Ofiai 


> > > > > > > From sitesmith.com] 
> > > > > > > беп ЕП gust 04, 2000 2:10 AM 
>> > > > > > To avistar.com 


> > > > > > > Subject: 15 this a real email address?? 
>>>>>>> 


>>>>>>> If this is a real address please respond... 
>>>>>>;> 

>>>>>>>-- 

>>>>>>> 

>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
>>>>>>-- 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > WAW.SIIeSmIII.Com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 

>>>>>-- 

>>>>> 

>>>>> 

>>>> 

>>>> 

> > > > > www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 
> > > > > Customer Care Center (888) 898 7667 
>>> >> 

> >>> 

> > > > -- 
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>> >> 
>>> > 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>> >> 

>>> 

>>>. 

>>> 


——————————————— 


> > > 


>> 
>> 
> > > www.sitesmitn.com 


> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 


> > www.sitesmith.com 
> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 


> 
> EN Е 


> "We are the master Internet Craftsmen" 
» Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


uu = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


EEE ee 


From: Lo bitesmitn.com] 


Sent: , 2000 1:10 PM 
To: 
Subject: plays stupid too 


X-Sieve: 
cmu-sieve 1.3 


Retur : 
nav-international.com> 


Received: 


navistar.com (mail.navistar.com 
y mailbox.sitesmith.com (Postfix) 


for 
itesmith.com>; Fri, 4 Aug 2000 11:08:13 -0700 
(PDT) 
Received: 


avistar.com with Internet Mail Service 
| Fri, 04 
ug 2000 13:09:44 -0500 
Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 13:09:41 -0500 
From: 
Г hav-intemational.com> 
Subject: 
RE: Is this a real email address?? 


+ 
[pastes com> 
Message-ID: 


sprxspn3.spr.navistar.com> 
MIME-version: 


1.0 
X-Mailer: 


Internet Mail Service]  ] 
Content-type: 


multipart/alternative; 
boundary="----_=_NextPart_001_01BFFE3F.28E42BA0" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


C 


where should i ftp? 
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b6 
BIG 


Fom|[ — —  PRÇsiesmithom] 
Sent: Friday, August 04, 2000 1:58 PM 

To 

Subject: Re: Is this a real email address?? 


Well, it would be nice to know why | was able to link your name to both 
the compromised site (which | can confirm is compromj 
anonymous and tell me what you see) and you being a 


[ wote: 


> 
> 


> Oh.. i see, If there is anything you need from me, let me know. 


> From: @sitesmith.com] 
> Sent: Eri 4, 2000 1:44 PM 

> To: 

> Subject: Re: Is this a real email address?? 

> 


> uh, yeah except the motherfucker is hacking my site. 
> 


> 
>> 
>> 


> > correct.. tjust | comandur.com, whatever content is on the 


> 
> > page is his own fault.. 


>> afaik[ ^ |siscom.net == comandur.com.. so nothing unusual is going 


> 
> > on here. 


>>--- Original Message----- 

> > From: @sitesmith.com] 
> > Sent: 2 g 

>>To: 

> > Subject: Re: Is this a real email address?? 

>> 


> > Sorry to leave you in the dark. comandur.com IS the hacker, and you 


> 


> Г. So | may need some help from you. The victim is 


> 


> > siscom.net ..... check out tomr.siscom.net 
>> 


> wrote: 


>>> 


> > > Okay, everything was going good for my day, then you mention 
> this.. 

>>> 

> > > ... then withhold details, like "One of the 350 websites you host 
> > was 

> > > hacked" 

>>> 


> > > eluding to 1115.net as the site that was hacked.. but yet i сап 


e 46 


-- 


~i бу 
о 


> find 

>> 

> > > no signs anywhere... 

>>> 

> > > |f you would be so kind, please email me a link to a hacked page, 
> so 

>> 

> > > some other proof.. This is driving me crazy. 

>>> 

> > > Thank You 


>> 
>> 
> > > Navistar international 


>>> 


> > > Subject: Re: Is this a real email address?? 
>>> 


> > > A site you [was hacked.... 


>>> 


>> 


>>>> 
>>>> 


> > > > which site was hacked? апа what makes you think it was hacked? 
>>>> 


> > > > Subject: Re: Is this a real email address?? 
> >>> 


> > > > Apparently you didn't understand my response. Your email is 


> > > plastered 
> > > > all over a website that was hacked, and more importantly, youl | 


> 

> 

>>> 

> > > > for 


> > > > this hacked website. 

> > > > 

>>>> 

>>>>> 

>>> >> 

> > > > > what makes you think that? 

>>> >> 

> > > > > ----- 

> > > > > Fro sitesmith.com] 
> > > > > Sent: Friday, August 04, 2000 11:19 AM 

>>> > > To 

> > > > > Subject: Re: Is this a real email address?? 

>> >>> 

> > > > > Actually, | would like to be even more specific...... | got 
> your 

>> 

> > > > email 

>>> >> 

> > > > > address from a hacked website. 

>> >>> 
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- ON 


>> >>> 

>>>>>> 

>>>>>> 

> > > > > > Yes і do... get my email address from whois information? 
>>>>>> 

> > > > > > ----- Oriai 

> > > > > > From: sitesmith.com] 
> > > > > > Sent: Eri t 04, 2000 10:59 AM 

>>>>>>Т 

> > > > > > Subject: Ке: Is this a real email address?? 

>>>>>> 

> > > > > > Let me ask you something.... .do you have any affiliation 

> with 

>> 

> > > > > > 1115.net? 

>> >>> 

>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > This HAS о be the weirdest email | have had in a while. 
>> >> >>> 

> > > > >>>- Original Message----- 

> > > > > > > From: 
> > > > > > > Sent: 
>> >> >>> То: 
> > > > > > > Subject: Is this a real email address?? 
>>> >> >> 

>>>>>>> If this is а real address please respond... 
>>>>>>> 

>> > > > > > -- 

>>> > >>> 


>>>>>> 
>>>>>> 
>>>>>> 


> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen” 
> > > > > > > Customer Care Center (888) 898 7667 
>>> > >>> 

>>>>>> 

> > > > > > -- 

>>>>>> 


>>>>>> 


>>>>>> 
>>>>>> 
>>>>>>Wwww.sitesmiin.com 


> >>> >> "We аге the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 

>>> >> 

>> >>> 

>> >>> 


> > > > > 


>>> > 
>> >> 
> > >>> .51 tin.com 


> > > > > "We are the master Internet Craftsmen" 
> > > > > Customer Care Center (888) 898 7667 
>>>>> 

>>>> 

>>>>-- 

>>>> 


>>> - 
>>> 


48 


>>> 
>>> > й n 
> > > > "We аге the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>> > 


>>> 

> > > -- 

>>> 

>>> 

>>> 

>>> 

> > > www.sitesmith.com 

> > > "We аге the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

>>-- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 
> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


wa. = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: 2 Bsitesmith.com] 


Sent: , 2000 1:09 PM 


Subject: Me playing stupid 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
[ — — меті com 


Date: 
Fri, 04 Aug 2000 13:57:57 -0400 


Fr 
X-Mailer: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 
To: 


| — 


Subject: 
Re: Is this a real email address?? 
References: 


@sprxspn3.spr.navistar.com> 
Content-Type: 
text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
7bit 


Well, it would be nice to know why 1 was able to link your name to both 
the compromised site (which | can confirm is compromised....ftp in as 
anonymous and tell me what you see) and you being T j 


> 
> 


> Oh.. i see, If there is anything you need from me, let me know. 


> From: sitesmith.com] 


> Sent: Friday, August 04, 2000 1:44 PM 
> Tof на 


> Subject: Re: Is this a real email address?? 
> 


> uh, yeah except the motherfucker is hacking my site. 


> 


> 
>> 


50 


>> 
> > correct.. | js[ — |comandur.com, whatever content is on the 


> 
> > page is his own fault.. 


>> 
>> afak[ — Piscom.net == comandur.com.. so nothing unusual is going 


> 
> > on here. 


> > ----- Original Message----- 

> > From itesmith.com] 
> > Sent: Fri 04, 2000 1:29 PM 

> > To: 

> > Subject: Re: Is this a real email address?? 

>> 


> > Sorry to leave you in the dark. comandur.com IS the hacker, and you 


> 


> Ре So | may need some help from you. The victim is 


> 


> > siscom.net ..... check out tomr.siscom.net 
>> 


>> 


>>> 

> > > Okay, everything was going good for my day, then you mention 
> this.. 

>>> 

> > > ... then withhold details, like "One of the 350 websites you host 
> > was 

> > > hacked" 

>>> 

> > > eluding to 1115.net as the site that was hacked.. but yet i can 
> find 

>> 

> > > no signs anywhere... 

>>> 

> > > If you would be so kind, please email me a link to a hacked page, 
> so 


>> 
> > > some other proof.. This is driving me crazy. 

>>> 

> > > Thank You 

>> 

>> 

> > > Navistar International 

>>> 

>>>---- Original Message----- 

> > > From itesmith.com] 
> > > Sent: Fri 04, 2000 12:45 PM 

>>> To: 

> > > Subject: Re: Is this a real email address?? 

>>> 


> > > A site y| fr was hacked.... 
>> 


>>> 
>>>> 
>>>> 


> > > > which site was hacked? and what makes you think it was hacked? 


@ š 


b6 
bic 


> > > > From sitesmith.com] 
> > > > беш Е 04, 2000 12:18 PM 

>>>>T 

> > > > Subject: Re: Is this a real email address?? 

> >>> 


> > > > Apparently you didn't understand my response. Your email is 
> > > plastered 
> > > > all over a website that was hacked, and more importantly, yo[ ] 


> 
Sm 
>>> 

> > > > for 


> > > > this hacked website. 
>>> > 


>>> wrote: 

> >>> 

>> >>> 

>> >>> 

> > > > > what makes you think that? 

>> >>> 

> > > > > ----- Orjai 

> > > > > From: @sitesmith.com] 
> > > > > Sent-Eri t 04, 2000 11:19 AM 

>> >>> To: 

> > > > > Subject: Re: Is this a real email address?? 

>>>>> 

> > > > > Actually, | would like to be even more specific...... | got 
> your 

>> 

> > > > email 

>>> >> 


> > > > > address from a hacked website. 
>>>>> 


>> > >> 
>>>>>> 
>>>>>> 


> > > > > > Yes | do... get my email address from whois information? 
>>> >>> 


> > > > > > ----- Original Message----- 
<<<<<< 52 НЕН 212, 
> > > > > > Sent: Friday, August 04, 2000 10:59 

p] 


>>>>>>To: 

> > > > > > Subject: Re: Is this a real email address?? 

>>>>>> 

> > > > > > Let me ask you something.... .do you have any affiliation 
> with 

>> 

> > > > > > 1115.net? 

>>>>>> 

>>>>>> [ wrote: 

>>> >>> 

> >>> >>> 

>>> > >>> 

> > > > > > > This HAS to be the weirdest email | have had in a while. 
>>>>>>> 

> > > > > > > ----- Oriqinal Messaqe----- 

> > > > > > > From: sitesmith.com] 


> > > > > > > Sent: Friday, August 04, 2000 2:10 AM 
>>> > >>> Tof Pavistercom 
> > > > > > > Subject: Is mis a real email address?? 


>>>>>>> 


>>>>>>> If this is а real address please respond... 
>>>>>>> 


> > > > > > > -- 

>>>>>>> 

>>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 

> > > > > > -- 

>>>>>> 

>>>>>> 

>>>>> 

>>> р р 

> > > > > >www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 

>>>>>-- 

>>>>> 

>>>>> 

>>>>> 

>>>>> 

> > > > > www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


>>>> 
>>>>-- 

>>>> 

>>>> 

>>>> 

>>>> 

> > > > WWW.silesmitn.com 

> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
> >>> 


>>> 

> > > -- 

>>> 

>>> 

>> 

>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

> > 

> > 

> 

> 

> > WWW.sitesmith.com 

> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
> -- 
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> WWW.Sitesmith.com 
> "We аге the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: [— —— iesmith.com] 
Sent: Thursday, Auqust 17, 2000 1:08 PM 

To: 

Subject: | ns my irritation 

X-Sieve: 


cmu-sieve 1.3 


Return- : 
av-international.com> 


Received: 


) 


Received: 
from 


by navistar.com (PMDF ` 


om> for 
ri, 4 Aug 2000 12:46:14 CST 
Received: 
b navistar.com with Internet Mail Service 


id <P5MBYBHL>; Fri, 04 
2000 12:46:13 -0500 
Content-return: 


allowed 
Date: 


Fri, 04 Aug 2000 12:45:50 -0500 


Fr 
| — — — —  Jonavitemetional.com» 


Subject: 
RE: Is this a real email address?? 


I 
[— — Jestesnit.com 
Message-ID: 


sprxspn3.spr.navistar.com> 
MIME-version: 


1.0 
X-Mailer: 


Internet Mail Servic j] 
Content-type: 


multipart/alternative; 


boundary="----_=_NextPart_001_01BFFE3B.D416C1D0" 
X-Mozilla-Status: 


8013 
X-Mozilla-Status2: 
00000000 


ЗЕ 
Oh.. i see, If there is anything you need from me, let me know. 
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Subject: Re: Is a real email address?? 


uh, yeah except the motherfucker is hacking my site. 


2 Мо 


> 
> 


> correct.. Іші ГГ ог comandur.com, whatever content is on the 
> page is his own fault.. 


> 
> afak[  BEiscom.net == comandur.com.. so nothing unusual is going 
> on here. 


> From sitesmith.com] 
> Sent: Friday, August 04, 2000 1:29 PM 
>To 


> Subject: Re: Is this a real email address?? 
> 


> 
>L wote: 

> 

>> 

>> 

> > Okay, everything was going good for my day, then you mention this.. 
>> 


> > ... then withhold details, like "One of the 350 websites you host 
> was 

> > hacked" 

>> 


> > eluding to 1115.net as the site that was hacked.. but yet i can find 


> 
> > no signs anywhere... 
>> 


> > lf you would be so kind, please email me a link to a hacked page, so 


> 

> > some other proof.. This is driving me crazy. 
>> 

> > Thank You 

>> 

>> 


> > Navistar International 
>> 


> > From sitesmith.com] 
> > Sent: Friday, August 04, 2000 12:45 PM 
>>To 


> > Subject: Re: Is this a real email address?? 
>> 


>> A site y фе was hacked.... 


> > 


>> 
>>> 
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>>> 


> > > which site was hacked? and what makes you think it was hacked? 
>>> 


>>>----- OriainaLMessadaex---- 

> > > From sitesmith.com] 
> > > Sent: Friday, August 04, 2000 12:18 PM 

> > > Subject: Re: Is this a real email address?? 

>>> 


> > > Apparently you didn't understand my response. Your email is 
> > plastered 
> ver a website that was hacked, and more importantly, you | 


> > > this hacked website. 
>>> 


>>> 

>>>> 

>>>> 

> > > > what makes you think that? 
> >>> 


> > > >From @sitesmith.com] 


> > > > Subject: Re: Is this a real email address?? 
> >>> 


> > > > Actually, | would like to be even more specific...... | got your 


> 
> > > email 
> >>> 


> > > > address from a hacked website. 
> >>> 


> >>> 
>> >>> 
>> >>> 


> > > > > Yes | do... get my email address from whois information? 
>>>>> 


>>>>>Fom| — — — — Jasitesmith.com] 
.` O A 


> > > > > Subject: Re: Is this a real email address?? 
>> >>> 


> > > > > Let me ask you something.... .do you have any affiliation with 


> 
>>>>>1115.net? 
>>>>> 

>>>>> 
>>>>>> 
>>>>>> 


> > > > > > This HAS to be the weirdest email | have had in a while. 
>>>>>> 


> > > > > > From 
> > > > > > Sent: 
>>> >>> То 
> > > > > > Subject: Is this a real email address?? 
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>>>>>> 

>>>>>> If this is а real address please respond... 
>>>>>> 

> > > > > > -- 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 


>>>>> 
>>>>>-- 
>>>>> 


зы _ LG 
>>>> 

>>>> 

> > > > > www.sitesmith.com 


> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>P> >>> 


> > > > www.sitesmith.com 
> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>> >> 


> > > www.sitesmith.com 
> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

> > 

> 

> 

> > www.silesmitn.com 


> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

>-- 

> 

> 


> M " 


> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 
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www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


mum = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: sitesmith.com] 


Sent: , 2000 1:07 PM 
To: 


Subject: Me getting irritated 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Me - 
itesmith.com> 


Date: 
Fri, 04 Aug 2000 13:44:10 -0400 


F 
| pesmico 


X-Mailer: 
Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 


nternational.com> 
ubject: 

Re: Is this a real email address?? 
References: 


{ —— —  losrepnssprnavstar com 
ontent-Type: 


text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 


uh, yeah except the motherfucker is hacking my site. 


[ — wote: 


> 
> 


> correct.. ljus[ —  ]comandur.com, whatever content is on the 
> page is his own fault.. 


> 
> afak[ ^^ biscom.net == comandur.com.. so nothing unusual is going 
> on here. 


2 

> ----- Ог шпа Меѕѕаае === 

> From: sitesmith.com] 
> Sent: Friday, Auqust 04, 2000 1:29 PM 

>T 

> Subject: Re: Is this a real email address?? 

> 


> Sorry to leave vou in the dark. comandur.com IS the hacker, and you 
{hin So need some help from you. The victim is 
> Siscom.net ..... check ou siscom.net 


> 
® 


1 бу 


> 


>> 
>> 


> > Okay, everything was going good for ту day, then you mention this.. 
>> 


> > ... then withhold details, like "One of the 350 websites you host 
> was 

> > hacked" 

>> 


> > eluding to 1115.net as the site that was hacked.. but yet i can find 


> 
> > no signs anywhere... 
>> 


> > |f you would be so kind, please email me a link to a hacked page, so 


> 

> > some other proof.. This is-driving me crazy: 
22 

>> 

>> 

>> 

> > Navistar International 


> > ----- Original Messaqe----- 

> >From sitesmith.com] 
> > Sent: Fri 04, 2000 12:45 PM 

>>To 


> > Subject: Re: Is this a real email address?? 
>> 


»»Asieyou[ ^ ^ ^ was hacked... 


>> 
sl wrote: 
>> 
>>> 
>>> 


> > > which site was hacked? and what makes you think it was hacked? 
>>> 


>>>Т 


>>>5 "RE: IS areal email address?? 
>>> 


> > > Apparently you didn't understand my response. Your email is 


> > plastered 
rj over a website that was hacked, and more importantly, youl | 
> 


>> XL] 
> > > this hacked website. 
>>> 


>>> 
> >>> 
> >>> 


> > > > what makes you think that? 
> >>> 
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>>> > 
> > > > Actually, | would like to be even more specific...... | got your 


> 
> > > email 

>> >> 

> > > > address from a hacked website. 


>>> 
>> >> 
>>>>> 
>>>>> 


> > > > > Yes l do... get my email address from whois information? 
>> >>> 


> > > > > From 
> > > > > Sent: 
>> >> > To 
> > > > > Subject: Re: Is this a real email address?? 
>>> >> 


> > > > > Let me ask you something.... .do you have any affiliation with 


> 

>> >> > 1115.net? 

> >>> 
| — Мә 
>>>>> 

>>>>>> 

>>>>>> 


> > > > > > This HAS to be the weirdest email | have had in a while. 
>>>>>> 


> > > > > > From: 
3 


> > > > > > Sent: Friday, Augus : 
>> >> >> To navistar.com 
> > > > > > Subject Ts this a real email address?? 


>>>>>> 

>>>>>> If this is а real address please respond... 
>>>>>> 

>>> >>> 

>>> >>> 

>>>>> 

>> >>> 

>>>>> 

> > > > > > wwwssitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


> > > > > www.sitesmith.com 
> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


> > > > www.sitesmith.com 2 
> > > > "We are the master Internet Craftsmen" БЕ 


> > > > Customer Care Center (888) 898 7667 
>> >> 


>>> 
> > > -- 
>>> 
>>> 


>> 
>> 
> > > www.sitesmitn.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
> > -- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 
> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


— = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: 
Sent: 
To: 


Subject: elling me more things 


X-Sieve: 
cmu-sieve 1.3 


Return- 2 
av-international.com> 
Recelved: 


avistar.com (mail.navistar.com 


by mailbox i Postfix) 
ith ESMTP id for 
E о о Fri, 4 Aug-2000 10:31:36 -0700 
(PDT) 
Received: 


y navistar.com (PMDF 


ith ESMTP id 
navistar.com> for 
sitesmith.com; Fri, 4 Aug 2000 12:33:13 CST 


istar.com with Internet Mail Service 
id Fri, 04 
Aug 2000 12:33:12 -0500 
Content-return: 
allowed 
Date: 


Fri, 04 Aug 2000 12:33:08 -0500 


Fri 


Subject: 
RE: Is this a real email address?? 


[=== вые 


Message-ID: 


Lw 5 = 
~version: 


1.0 
X-Mailer: 
Internet Mail Sevc| | 
Content-type: 
multipart/alternative; 


boundary="----_= МехіРагі 001 01ВЕҒЕЗА.0ЕЗ7СЕ00" 
X-Mozilla-Status: 


8013 
X-Mozilla-Status2: 
00000000 


g= 


correct.. | jus... — lender. com, whatever content is on the 
page is his own fault.. 


afail] þiscom.net == comandur.com.. so nothing unusual is going on 
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From sitesmith.com] 


Sent: Friday, August 04, : 
Subject: Re: Ts this a real email address?? 


Sorry L js dark. comandur.com 15 the hacker, and you 
provide So eed some help from you. The victim is 
siscom.net ..... check out i 


iscom.net 
2 wrote: 


> 
> 5 

> Okay, everything was going good for ту day, then уои mention this.. 
> 

> ... then withhold details, like "One of the 350 websites you host was 
> hacked" 

> 

> eluding to 1115.net as the site that was hacked.. but yet i can find 

> no signs anywhere... 

> 

> If you would be so kind, please email me a link to a hacked page, so 


> some other proof.. This is driving me crazy. 
> 


>| 
>| 


> Navistar International! 


> ----- Original Меѕѕаае----- 

> From: sitesmith.com] 
> Sent: t 04, 2000 12:45 PM 

> To: 

> Subject: Re: Is this a real email address?? 

> 


> А site you [for was hacked... 
> 
b ote: 


> 
>> 
>> 


> > which site was hacked? and what makes you think it was hacked? 
>> 


> > From sitesmith.com] 

> > Sent: Fri 04, 2000 12:18 PM 

>>To: 

> > Subject: Re: Is this a real email address?? 

>> 

> > Apparently you didn't understand my response. Your email is 

> plastered 

> > all over a website that was hacked, and more importantly, yd | 


> 
> > for 


> > this hacked website. 
>> 


^1. uote: 


>> 
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>>> 


>>> 


> > > what makes you think that? 
>>> 


> > > From: sitesmith.com] 
> > > Sent-Eri 04, 2000 11:19 AM 

>>> To 

> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Actually, | would like to be even more specific...... 1 got your 
> > email 

>>> 


> > > address from a hacked website. 
>>> 


>>> 

>>>> 

>>>> 

> > > > Yes | do... get my email address from whois information? 
>> >> 


>>>>----- Original Message----- 


> > > > From itesmith.com] 
> > > > Sent; Eri st 04, 2000 10:59 AM 

>> > > To 

> > > > Subject: Re: Is this a real email address?? 

>>>> 


> > > > Let me ask you something.... .do you have any affiliation with 
>> > > 1115.net? 

>>> > 

>>> > 

>>> >> 

>>> >> 


> > > > > This HAS to be the weirdest email | have had in a while. 
>>>>> 


> > > > > Subject: Is this a real email address?? 
>>> >> 


>>> >> If this is a real address please respond... 
>>> >> 

>>> > > -- 

>> >>> 

>>>> 

>>>> 

>>>> 

> > > > > www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


>>>> 
>>>>-- 

>>>> 

>>> 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>> >> 


>>> 
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ل ا 


>>>- 
>>> 
>>> 


> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 


>> 
> > -- 
> > 
> > 


> > "We аге the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

> «+ 

> 

> 


> www.sitesmith.com 
> "We аге the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


>> 
>> 
> > > www.sitesmith.com 


> 
> 
> > www.sitesmiin.com 


> 
> 
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From: Lg Bsitesmith com 
Sent: ursday, August 17, 2000 1:06 PM 

To: [ J 

Subject: me letting him Know T am worn out 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
itesmith.com> 


Date: 
Fri, 04 Aug 2000 13:29:20 -0400 


Fr 
L — равно» 


X-Mailer: 
Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 


| === 


Subject: 
Re: Is this a real email address?? 
References: 


lw [@sprspna.spr.navistar.com> 
ontent-Type: 


text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 


I have been up for 2 days now and need to get some rest now. I'll share 
more info as it becomes available 


> 

> 

> Okay, everything was going good for my day, then you mention this.. 
> 

> ... then withhold details, like "One of the 350 websites you host was 
> hacked" 

> 

> eluding to 1115.net as the site that was hacked.. but yet i can find 

> no signs anywhere... 

> 


> If you would be so kind, please email me a link to a hacked page, so 
> some other proof.. This is driving me crazy. 
> 


> 
> 
> 


> Navistar International 
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= ا‎ 2-сі 


b6 
b7C 


> From 


> Sent: Friday, August 04, 2000 12:45 PM 


Б караан 


> Subject: Re: Is this a real email address?? 


> 


> A site yol was hacked.... 


a 


> 
>> 
>> 


> > which site was hacked? and what makes you think it was hacked? 


> > Subject: Re: Is this a real email address?? 
>> 


sitesmith.com] 


> > Apparently you didn't understand my response. Your email is 


> plastered 


> > all over a website that was hacked, and more importantly, you 


> 


> 

>> =i hacked website. 
> 

T We 


>> 
>>> 
>>> 


> > > what makes you think that? 
>>> 


>> > To: 


> > > Subject: Re: Is this a real email address?? 


>>> 


> > > Actually, | would like to be even more specific 


> > email 
>>> 


> > > address from a hacked website. 


>>> 
>>> 
>>> > 
>> >> 


> > > > Yes | do... get my email address from whois information? 


>>> > 


>> >> 


> > > > Let me ask you something.... .do you have any affiliation with 


> > > > 1115.net? 

>>>> 

dog wote: 
>>> > 

>>> >> 
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>> >>> 
> > > > > This HAS to be the weirdest email 1 have had in a while. 
>> >>> 

> > > > > ----- Original Меѕѕаае----- 

>>>>> From: sitesmith.com] 
> > > > > Sent Eri ust 04, 2000 2:10 AM 

> > > > > To: avistar.com 

> > > > > Subject: Is this a real email address?? 

>> >>> 

>>> >> If this is a real address please respond... 

>> >>> 

>>>>>-- 

>>>>> 


>>>>> 


>>>> 
>>>> 
> > > > > www.sitesmith.com 


> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 

>>>> 

>>> >- 

> >>> 


> >>> 


>>> 
>>> 
> > > > wwwssitesmith.com 


> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
> >>> 

>>> 

> > > -- 

>>> 


>>> 

>> 

>> 

> > > www.sitesmitn.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
>>-- 


>> 
эк== се е 22 
> 
> 


> > www.sitesmith.com 
> > "We аге the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 
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www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 


Customer Care Center (888) 898 7667 
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ا ڪڪ 


From: [— — Rp Bsitesmith.com] 
Sent: Thursd 7, 2000 1:05 PM 

To: | | 

Subject: e playing соу 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
[ists com> 
Date: 


Fri, 04 Aug 2000 13:28:44 -0400 


Fr 
LT lastesmith.com» 


X-Mailer: 
Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 
To: 


| — — 


Subject: 
Re: Is this a real email address?? 
References: 


LE Jasmspná sprevit com 
ontent- Type: 


text/plain; charset-us-ascii 
Content-Transfer-Encoding: 
Tbit 


lL uot: 


> 

> 

> Okay, everything was going good for my day, then you mention this.. 
> 

> ... then withhold details, like "One of the 350 websites you host was 
> hacked" 

> 

> eluding to 1115.net as the site that was hacked.. but yet i can find 

> no signs anywhere... 

> 

> If you would be so kind, please email me a link to a hacked page, so 


> some other proof.. This is driving me crazy. 
> 


> 
> 
> 
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> Navistar International 


> From: sitesmith.com] 
> Sent: Eriday, August 04, 2000 12:45 PM 

> To: 

> Subject: Re: Is this a real email address?? 


> 

> A sitq — as hacked... 
> 

T — wote: 


> 
>> 
>> 


> > which site was hacked? and what makes you think it was hacked? 
>> 


Ae NAM 
>> From кишннин соп 
> > Sent: Friday, Augus ; 5 
ор | 


> > Subject: Re: Is this а real email address?? 

>> 

> > Apparently you didn't understand my response. Your email is 

> plastered 

> > all over a website that was hacked, and more importantly, уй Î] 


> 
> 


> > this hacked website. 
>> 


44 wrote: 


>>> 


> > > what makes you think that? 
>>> 


>>>---- OriainaL Messade----- 

dee T NENNEN C сот 
> > > Sent: Friday, Augus ; : 
оор — j 


> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Actually, | would like to be even more specific...... | got your 
> email 

>>> 

> > > address from a hacked website. 

>>> 


>>> 
> >>> 
> >>> 


> >>> Yes | do... get my email address from whois information? 
> >>> 


>>>>----- Original Messaqge----- 
> > > > From: sitesmith.com] 
> > > > Sent: ЕП = =“ ; : 


>> >> To 


> > > > Subject: Re: Is this a real email address?? 
> >>> 


> > > > Let me ask you something.... .do you have any affiliation with 
> > > > 1115.net? 


>>> 
>>> uote: 
>>>> 
73 


>>>>> 


>>>>> 
> > > > > This HAS to be the weirdest email | have had іп а while. 
>> >>> 

> > > > > ----- Oriqinal Messaqe----- 

> > > > > Erom: sitesmith.com] 
> > > > > Sent: Friday, August 04, 2000 2:10 AM 

озо Дог 

> > > > > Subject: Is this a real email address?? 

>>> >> 

>>> >> If this is a real address please respond... 

>>> >> 

>> > > > -- 

>>> >> 

>>> >> 

>>> > 

>>> > 

> > > > > WWW.sitesmith.com 

> > > > > "We аге the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


> > > > www.sitesmith.com 
> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>> > 

>>> 

>>>... 

>>> 


————————————M—————————————————— 


>>> 

>> 

>> 

> > > www.sitesmith.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
>>-- 

>> 

Sette oo O т == m 
>> 

>> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 

> > Customer Care Center (888) 898 7667 

>> 

> 

>-- 

> 

> 


> www.sitesmith.com 
> "We аге the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 
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www.sitesmith.com 
"We аге the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


нет s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: sitesmith.com] 


Sent: ursday, Augus :05 PM 
To: 

Subject: More psychobabble 

X-Sieve: 


cmu-sieve 1.3 
Return-Path: 
nav-international.com> 


Received: 
fro avistar.com (mail.navistar.com 


С фута юеш ошон 
with ESMTP id or 
[  — Ebitesmith.com»; Fri, 4 Aug 2000 10:12:12 -0700 


(PDT) 
Received: 


y navistar.com (PMDF - 


with ESMTP id 
navistar.com> for 
sitesmith.com; Fri, 4 Aug 2000 12:13:54 CST 
Received: 
b navistar.com with Internet Mail Service 
id Fri, 04 

Aug 2000 12:13:54 -0500 
Content-return: 

allowed 

Date: 
Fri, 04 Aug 2000 12:13:51 -0500 


F 
2 ravsinterational.com> 


Subject: 
RE: Is this a real email address?? 


sitesmith.com> 
Message-ID: 


[q sors pr naviter. com> 
-Version: ` 


1.0 


X-Maller: 
Internet Mail seed | 
Content-type: 
multipart/alternative; 
boundary="---- = NextPart_001_01BFFE37.5C7AEECO" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


[ |] 


Okay, everything was going good for my day, then you mention this.. 


... then withhold details, like "One of the 350 websites you host was 


hacked" 
e | 
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eluding to 1115.net as the site that was hacked.. but yet i can find no 
signs anywhere... 


If you would be so kind, please email me a link to a hacked page, so 
some other proof.. This is driving me crazy. 


avistar International 


Subject: Re: Is this a real email address?? 


A site you фе hacked.... 
[U wrote: 


> 
> 


> which site was hacked? and what makes you think it was hacked? 
> From: sitesmith.com] 


> Subject: Re: Is this a real email address?? 
> 


> Apparently you didn't understand my response. Your email is L 


> all over a website that was hacked, and more importantly, yo 


> this hacked website. 
> 


>L C мо: 

> 

>> 

>> 

> > what makes you think that? 

>> 

>>--- Original Messaqe----- 

> > Sent: Friday, August 04, р 

| ae 

> > Subject: Re: Is this a real email address?? 
>> 

> > Actually, | would like to be even more specific...... | got your 
> email 

>> 

> > address from a hacked website. 

>> 

>> 

>>> 

>>> 


> > > Yes | do... get my email address from whois information? 
>>> 


> > > ----- Original Message----- 
77 


ж 
© 
4% 

i 


>>>Fom[ test. cor 


> > > Sent: Friday, August 04, 2000 10:59 АМ 
aequ | 


> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Let me ask you something.... .do you have any affiliation with 
> > > 1115.net? 

>>> 

>>> 

>>> > 

>> >> 

> > > > This HAS to be the weirdest email | have had in a while. 
>>>> 

> > > > ----- Original Messaqe----- 

> > > > From sitesmith.com] 
> > > > Sent Eri gust 04, 2000 2:10 AM 

>>> > То navistar.com 

> > > > Subject: Is this a real email address?? 

>>> > 

>> >> If this is a real address please respond... 

>>>> 

>>> > -- 

>>>> 

>> >> 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>> >> 


>>> 
>> > -- 

>>> 

> > > 

>> 

>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

>>. 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

>-- 

> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
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ШШ " 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


EN i 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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ئ = 


- бу 
о 


From: @sitesmith.com] 


Sent: 2000 1:04 PM s 
í 

To: 

Subject: sking for more info 


X-Sieve: 
cmu-sieve 1.3 


Retur i 
nav-international.com> 


Received: 


from þhavistar.com (mail.navistar.com 


by mailbox.sitesmith.com (Postfix) 
Wi for 
= = n Fri, 4 Aug 2000 09:45:53 -0700 
PDT) 


Received: 
fro avistar.com 
ist 


by navistar.com (PMDF 
with ESMTP id 

navistar.com> for 

sitesmith.com; Fri, 4 Aug 2000 11:47:27 CST 


.navistar.com with Internet Mail Service 
Fri, 04 Aug 


00 11:47:25 -0500 
Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 11:47:20 -0500 


F 
[ — Jansvintemationatcon: 
Subject: 


RE: Is this a real email address?? 


sitesmith.com» 
Message-ID: 


Po Bspnepnásspr.navista.cor 


MIME-version: 
1.0 
X-Mailer: 
Internet Mail Service | 
Content-type: 
multipart/alternative; 
boundary-"---- = NextPart 001 O1BFFE33.A84A92F0" 
X-Mozilla-Status: 
8011 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


I am going to need a bit more information if i am going to take action 
to correct this situation... from my end everything looks normal.. 
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@sitesmith.com] 


A site you [was hacked.... 


> 
> 


> which site was hacked? and what makes you think it was hacked? 


> ----- Original Меѕѕаае----- 
> From sitesmith.com] 


> Sent: Eriday, August 04, 2000 12:18 PM 
> Td | 


> Subject: Re: Is this a real email address?? 
> 
> Apparently you didn't understand my response. Your email is plastered 


CI a website that was hacked, and more importantly, you 
> 


> this hacked website. 
> 


^[ C hote: 

> 

>> 

>> 

> > what makes you think that? 


> > Subject: Re: Is this a real email address?? 
>> 


> > Actually, | would like to be even more specific...... | got your 
> email 
>> 


> > address from a hacked website. 
> > 


> 


>>> 
>>> 


> > > Yes | do... get my email address from whois information? 
>>> 


> > > To: 

> > > Subject: Re: Is this a real email address?? 

>>> 

> > > Let me ask you something.... .do you have any affiliation with 
> > > 1115.net? 

>>> 

>>> 

>>> > 

>>> > 


> > > > This HAS to be the weirdest email | have had in a while. 


>> >> 
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Is a real email address?? 


>>>> If this is a real address please respond... 


> >>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>>>> 

>>> 

> > > -- 

>>> 

>>> 

>> 

>> 

> > > WWW.sitesmith.com 

> > > "We are the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

> u 

> 


WWW.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
82 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: [. e bsitesmitn.com] ps 
Sent: Thursday, August 17, 2000 1:04 PM í 
To: 

Subject: Me clarifying his misinterpretation 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID; 
— рањо» 
ate: 


Fri, 04 Aug 2000 12:45:00 -0400 


Fr 
X-M 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 


nav-international.com> 
ubject: 

Re: Is this a real email address?? 
References: 


С Beensens sprnavistar com: 
ontent Type: 


text/plain; charset-us-ascii 
Content-Transfer-Encoding: 
Tbit 


A site yu — ав hacked.... 
NEN 


> 
> 

> which site was hacked? and what makes you think it was hacked? 
> 

> ----- Original Message----- 

> From: @sitesmith.com] 

> Sent: Friday, August 04, 2000 12:18 PM 

> Subject Re: Is this a real email address?? 

> 


> Apparently you didn't understand my response. Your email is {кишш 
> all over a website that was hacked, and more importantly, you 

> 

> this hacked website. 

> 


rte: 


> 


>> 


>> 
> > what makes you think that? 


>> 
> > -----Oriai m 

>> From lositesmith.com] 
> > Sent: Friday, August 04, : 

>>To:[ | 

> > Subject: Re: Is this a real email address?? 

>> 

> > Actually, | would like to be even more specific...... | got your 
> email 

>> 

> > address from a hacked website. 

>> 

>> 

>>> 

>>> 


> > > Yes | do... get my email address from whois information? 
>>> 


> > > ----- Original Messaqe----- 

> > > From: sitesmith.com] 
> > > Sent: Friday, August 04, 2000 10:59 AM 

> > > Subject: Re: [s this a real email address?? 

>>> 


> > > Let me ask you something.... .do you have any affiliation with 
> > > 1115.net? 

>>> 

> o ]wote: 

>>> 

>>>> 

>>>> 

> > > > This HAS to be the weirdest email | have had in a while. 
> >>> 

> > > > ----- Original Меѕѕаае----- 

> > > > From sitesmith.com] 
> > > > Sent: Friday, August 04, 2000 2:10 AM 

> >>> Т navistar.com 

> > > > Subject TS This a real email address?? 

>>> > 

>> >> If this is a real address please respond... 

>>>> 

> > > > -- 

>>>> 

>>> > 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 

> > > > Customer Care Center (888) 898 7667 

>>>> 

>>> 

> > > -- 

>>> 

>>> 


>>> 
>>> 
> > > www.sitesmiin.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
>>-- 
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>> 
> 
> 
> 
>> s 


> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


» Customer Care Center (888) 898 7667 
> А ы 2 x 


b6 
== b7C 


www.sitesmith.com 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


U i 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: [— — — Bsieninconl 
Sent: ursday, August 17, 2000 1:03 PM 


Subject: misinterpreting what | am saying 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 


A ااا ا‎ 
Receive 


fom ^  ] [ — ]nevistar. com (mail.navistar.com 


рыу mailbox.sitesmith.com EU‏ ا 
ESMTP id‏ 


LLL — — —Bsitesmith.com»; Fri, 4 Aug 2000.09:26:11 -0700 
(PDT) 
Ai NENNEN 


emus чинин by navistar.com (PMDF 
p k @navistar. Miis for 
р | Š Мевтіһ. com; Fri, 4 Aug 2000 11:27:52 CST 


Received: 
b istar.com with Internet Mail Service 
id Fri, 04 Aug 
2000 11:27:52 -0500 


Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 11:27:50 -0500 
From: 


Subject: 


RE: Is this a real email address?? 
To: 


sitesmith.com> 
Mess “ID: 
Fores spr nist com> 
version. 


1.0 


X-Mailer: 
Internet Mail Sed | 
Content-type: 
multipart/alternative; 
boundary="----_= NextPart_001_01BFFE30.EE845B00" 
X-Mozilla-Status: 
8011 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


Am I missing something, or are you implying that 1115.net was hacked? 


I'm not physically at the machine at the moment, but, from what l| see of 
the website, it looks ok. 


122222. 5 


87 


Subject: Re: Is this a real email address?? 
Apparently you didn't understand my response. Your email is 
all over a website that was hacked, and more importantly, you 


this hacked website. 


> 
> 


> what makes you think that? 


sitesmith.com] 


> Subject: Re: Is this a real email address?? 
> 


> Actually, | would like to be even more specific...... | got your email 


> 
> address from a hacked website. 


>> 
>> 


> > Yes | do... get my email address from whois information? 


> > Subject: Re: Is this a real email address?? 
>> 


> > Let me ask you something.... .do you have any affiliation with 
> > 1115.net? 
>> 


>> 


>>> 
>>> 


> > > This HAS to be the weirdest email | have had in a while. 
>>> 


itesmith.com] 


, 
navistar.com 
> > > Subject: Is this a real email address?? 
>>> 
>>> If this is a real address please respond... 
>>> 
>>>. 
>>> 
>>> 


E —À 
Ф 


b6 


> > > www.sitesmith.com 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

> > -- 

> > 

> > 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
> a 
> 
> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


ЕЕЕ 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


Sent: 2000 1:02 PM . b7C 
To: 
Subject: sking which site l was referring to 


X-Sieve: 
cmu-sieve 1.3 


Return- : 
| Janavintemationa com> 
Rec 3 
f 


m  havistar.com (mail.navistar.com 


TO 
[—— mailbox.sitesmith.com (Postfix) 
WI for 
L— — кшен Fri, 4 Aug 2000 09:17:39 -0700 
DT) 


Received: 


from ^ havistar.com 


Content-return: 
allowed 
Date: 
Fri, 04 Aug 2000 11:19:17 -0500 


Fr 
lL evintemationalcom> 
Subject: 


RE: Is this a real email address?? 
To: 


Message-ID" 


1.0 
X-Mailer: 
Internet Май Service[ ] 
Content-type: 
multipart/alternative; 
роџпаагу="---- = NextPart 001 01BFFE2F.BCE73410" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


which site was hacked? and what makes you think it was hacked? 


b6 
b7 


From sitesmith.com] 
Sent: 
To: 

Subject: Re: Is this a real email address?? 


Apparently you didn't understand my response. Your email is 
all over a website that was hacked, and more importantly, you 
this hacked website. | 


NEM 


> 
> what makes you think that? 


> 


> address from a hacked website. 
> 


> 
>> 
>> 


> > Yes | do... get my email address from whois information? 
>> : 


> > Subject: Re: Is this a real email address?? 
>> 


> > Let me ask you something.... .do you have any affiliation with 
>>1115.net? 
>> 


>> 
>>> 
>>> 


> > > This HAS to be the weirdest email | have had in a while. 
>>> 


> > > ----- Oriai = 

> > > Sent: Friday, August 04, 2000 2:10 AM 
>>> шшш; 

>>> Su М a real email address?? 


>>> 
>>> If this is а real address please respond... 
>>> 

>>>-- 

>>> 

>>> 

>> 

>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 


ө i 


> > > Customer Care Center (888) 898 7667 
>>> 

>> 

> > -- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

S 

> 

> 


> www.sitesmith.com 

> "We аге the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: [ [@sitesmith.com] 
Sent: pr 1:01 PM 

To: 

Subject: Me clarifying that he didn't understand what | said 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 
Mess - 
sitesmith.com> 
D 


Fri, 04 Aug 2000 12:18:29 -0400 


F 
(itt. com> 
X-Mailer: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 


nav-international.com> 
ubject: 


Re: Is this a real email address?? 
References: 
Co Bsprxspna.spr.navistar.com> 
Content-Type: 


text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 


Apparently you didn't understand my response. Your email is 
all over a website that was hacked, and more importantly, yo 
this hacked website. 


> 
> 

> what makes you think that? 

> 

> ----- OriqinaLMessaqe----- 

> From: sitesmith.com] 

> Sent: ЕП t 04, 2000 11:19 AM 

>To 

> Subject: Re: Ts this a real email address?? 

> 

> Actually, | would like to be even more specific...... | got your email 
> 

> address from a hacked website. 

> 


93 


>> 
>> 


> > Yes | do... get my email address from whois information? 


> > Subject: Re: Is this a real email address?? 
>> 


> > Let me ask you something.... .do you have any affiliation with 
> > 1115.net? 
>> 


>>> 


>>> 


> > > Subject: Is this a real email address?? 
>>> 


>>> If this is a real address please respond... 
>>> 


> > > -- 

>>> 

>>> 

>> 

>> 

> > > www.sitesmith.com 

> > > "We аге the master Internet Craftsmen" 
> > > Customer Care Center (888) 898 7667 
>>> 

>> 

Soc 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
> -- 
> 
> 


> WWW.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


[ _—_ |] 
ө 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


ЕЕС 


From: Г ————-Bstesmitucoml 
Sent ursdav, Auqust 17, 2000 1:01 PM 


To: | 
Subject: | пина what makes me think that 


X-Sieve: 
cmu-sieve 1.3 


Return- 
nav-international.com> 


Received: 


[ Jnavistar.com (mail.navistar.com 


ostfix) 
wit for 
sitesmith.com>; Fri, 4 Aug 2000 09:13:14 -0700 
(PDT) 
Received: 


by navistar.com (PMDF 
with ESMTP id 

navistar.com> for 

ith.com; Fri, 4 Aug 2000 11:14:51' CST 


avistar.com with Internet Mail Service 


Content-return: 


allowed 
Date: 
Fri, 04 Aug 2000 11:14:49 -0500 
From: 
nav-international.com> 
Sub 


RE: Is this a real email address?? 


sitesmith.com> 
Message-ID: 


1.0 


X-Mailer: 
Internet Mail Service| | 
Content-type: 
multipart/alternative; 
роџпаагу="---- = NextPart 001 O1BFFE2F.1D144950" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


what makes you think that? 


>. 


X 


FD-840b (Rev. 2-5-93) 


_ Universal Case File Number 2S “AN, 4216100 


Field Office Acquiring Evidence Aid, 


Serial # of Originating Document 
Date Received 


To Be Returned О Yes Ё No 
Receipt Given О Yes Й Мо 
Grand Jury Material - Disseminate Only Pursuant 
to Rule 6 (e), Federal Rules of Criminal Procedure 
О Yes № 
Title: UNIS (SY, | 
WWE = есе 


NiPc iP 


Goy 
Reference: 
(Communication Enclosing Material) 


Description: ІП Original notes re interview of 


PLEASE DO NOT REMOVE 
THIS SLIP FROM EXHIBIT 


| | 


From: 2 @sitesmith.com] 
Sent: Thurs 2000 1:35-РМ Бе 
Subject: ; Ente 


X-Sieve: 
cmu-sieve 1.3 


Retur : 
| nsvaematonatoony 
Rec : 
from[__navistar.com (mail.navistar.com 
С ьута j СШ). 


with ESMTP i for 
sitesmith.com>; Mon, 7 Aug 2000 13:28:54 -0700 Е 


) 
Received: : ^ 


from -navistar.com 
avistar.com by navistar.com (PMDF 
wi id 


navistar.com> for 
sitesmith.com; Mon, 7 Aug 2000 15:30:35 CST 


istar.com with Internet Mail Service 


i 
ПО 2000 15:30:30 -05 
Content-return: 
allowed 
Date: 
Mon, 07 Aug 2000 15:30:29.-0500 
From: 
nav-international.com> 
Sub 
FW: Is this a real email address?? 
To: 


C . 
T leneeiniematonat come 
Message-ID: 


sprxspn3.spr.navistar.com> 


MIME-version: 
1.0 
X-Mailer: 
Internet Mail бемсе j] 
Content-type: 
multipart/alternative; 
boundary="---- = NextPart 001_01C000AE.539ECF00" 
X-Mozilla-Status: 
9001 
X-Mozilla-Status2: 
00000000 


"LÀ 
[| 


My name i апаат] 


iscom.net. 
orwarded this conversation between you and him to me... 


For clarification: | received a message from[ — Jon Friday 
August 5th around 3:15pm that my IP address was "attacking" a site 
maintained by sitesmith.com. Since | was away from the site at the time 
and unable to verify this information, | had someone disconnect 

the server at approximately 3:20pm and attempted to retur ^ alll, 
however he was not at his phone. Since then, ! have left the 

server down so that | can determine if it has been compromised. 


Jumptotoday[ ^ ^ ]forwards this email to me and as | read 
through it | a letely confused as to what you are trying to say. 
You state thal emat is plastered all over the "hacked" web sites 

You say that the site has been hacked...you say that 
ы is hacked апа that the.compromised box attacked your 
client when you emailed фои say that tomr.siscom.net has 
hacked ndur.com...you say that comandur.com is the hacker and they 
һаске{ — fiscommnet... 


All of these statements are either utterly ridiculous or completely 
wrong. (or both) 


I know for a fact that no one was knowingly or intentionally "attacking" 
ANY sites from comandur.com/tomr.siscom.net/209.251.13.206. 


| am more than willing to assist you if | can, however, | need more 
information than what you have provided so far. What was the nature of 
the attack? What sites were being attacked? How long did the attack 
last? etc... 


You are making some very serious accusations and have provided no proof 
to substantiate them. 


mum 


To: 
Subject: FW: Is this a real email address?? 


Front NENNEN 
Sent: Monday, August 07, 2000 12:27 PM 

19) | 

Subject: RE: Ts This а real email address?? 

idle threats now... | like. Please refrain from emailing me again 

unless 1), its from your attorney. -or- 2), your willing to provide 

details, 

such as "Who got hacked" "When?" "From who?" "I got your email address 
from a hacked site" (which obviously you didnt, as you already 


said you got it from www.1115.net) "Why you think they were hacked" 
"Some sort of proof" "Proof you have a clue" (most important.) "And 


e x 


anything you can think of" 


سڪ 


P.S. If your that worried about your security that you wont provide any 
of these details, follow these instructions: 

1. Unplug the computer from the network. 

2. Shoot yourself in the head. 


Subject: Re: Is this a real email address?? 


BER cad is hacked and the person that compromised this box 
attacked my client when | emailed you. І am going to need records of who 


that domain belongs to and if you are not willing to cooperate, the FBI 
may be involved. 


> 
> 
siscom.net was NOT hacked by comandurcom|  þiscom.net iS 
> comandur.com. 
> 
> Thank you. :) 
> 


> Subject: Re: Is this a real email address?? 
> 


> The site that was hacked waq þiscom.net, the reason | link you to 


> 
> it is because you афф hacker, which means you must 


» have his info. 


> 
>L rote 


> 

>> 

>> 

> > You can link me to being hiss because i am.. 
>> 


> > How you can link me to the compromised site, i have no clue. | dont 
> > know which site is being hacked or was hacked. 

>> 

> > ----- іші === 

> > Егот sitesmith.com] 

> > Sent: Eri 4, 2000 1:58 PM 

>> To 

> > Subject: Re: Is this a real email address?? 

>> 

> > Well, it would be nice to know why l was able to link your name to 
> > both 

> > the compromised site (which 1 can confirm is compromised....ftp in 
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> as 


> > anonymous and tell me what you see) and you being | 


>> 


> wote: 


>> 


>>> 
>>> 


> > > Oh.. i see, If there is anything you need from me, let me know. 
>>> 


> > > -----Original Меѕѕаае----- 

> > > prom i — stesmithconi 
> > > Sent: t 04, 2000 1:44 PM 

> > > To: 

> > > Subject: Re: Is this a real email address?? 

>>> 


> > > uh, yeah except the motherfucker is hacking my site. 

>>> 

>>> 

> >>> 

>>>> 

> > > > correct.. | justdo[ ^ ]comandur.com, whatever content is on 


> 
> > the 

>>> 

> > > > page is his own fault.. 

>>> > 

>> >> afak| — biscom.net == comandur.com.. so nothing unusual is 
> > going 

>>> 

> > > > on here. 

>>>> 


> > > > From sitesmith.com] 


> > > > Sent: Friday, А 4, 2000 1:29 PM 
>> > > To: 


> > > > Subject: Re: Is this a real email address?? 
>>>> 


> > > > Sorry to leave you in the dark. comandur.com IS the hacker, and 


> 
> > you 

>>> 

>>> Û fim. So | may need some help from you. The 
> victim 

> > is 

>>> 


>>>]... check ou| iscom.net 


> > > > 

»»»1 сов: 

>>>> 

>> >>> 

>>>>> 

> > > > > Okay, everything was going good for ту дау, then you mention 
> > > this.. 

>>> >> 

> > > > > ... then withhold details, like "One of the 350 websites you 
> > host 

>>>> was 

> > > > > hacked" 

>P> >>> 

> > > > > eluding to 1115.net as the site that was hacked.. but yet i 


> can 
30 
б v 


> > > find 

> >>> 

> > > > > no signs anywhere... 
>>> >> 

> > > > > lf you would be so kind, please email me a link to a hacked 
> > page, 

> > > so 

> >>> 

> > > > > some other proof.. This is driving me crazy. 

>>>>> 

> > > > > Thank You 

> >>> 

>>>> 


> > > > > Navistar International 
>>>>> 


> > > >> From: 
> > > > > Sent: 
>>> >> To: 


> > > > > Subject: Re: Is this a real email address?? 
>>>>> 


>> > > > A site y| ^ фе hacked... 


> > > > > 

>>>>> 

>>>>>> 

>>>>>> 

> > > > > > which site was hacked? and what makes you think it was 


> hacked? 
>> 


>>>>>> 
> > > > > > ----- Original Message----- 
> > > > > > From 
> > > > > > Sent: 
>>> >>> To 
> > > > > > Subject: Re: Is this a real email address?? 

>>>>>> 

> > > > > > Apparently you didn't understand my response. Your email is 
> > > > > plastered 

> > > > > > all over a website that was hacked, and more importantiy, 

> you 

> > do 

>>> 

>>>> DNS 

>>>>> 

>>>>>>for 

> > > > > > this hacked website. 

>>> >>> 

222221 ^ uote: 

>>> >>> 

>>>>>>> 

>>>>>>> 

> > > > > > > what makes you think that? 

>>>>>>> 

>> > > > >>- Original Message----- 

> > > > > > > From 
> > > > > > > Sent: 
>> > > > > > To: 
> > > > > > > Subject: Re: Is this a real email address?? 
>>>>>>> 

> > > > > > > Actually, | would like to be even more specific...... | 
> got 

> > > your 

>> >> 


sitesmith.com] 


sitesmith.com] 
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> > > > > > email 
>>>>>>> 


> > > > > > > address from a hacked website. 
>>>>>>> 


>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > Yes | do... get my email address from whois 
> information? 

>>> >>>>> 

> > > > > >>>- Original Messade----- 

> > > > > > > > From 
> > > > > > > > Sent: 
>> > > > > > > To: 
> > > > > > > > Subject: 
>>>>>>>> 

> > > > > > > > Let me ask you something.... .do-you һауе апу 

> affiliation 

> > > with 

> >>> 

>>>>>>>>1115.net? 

>>>>>>> 

С аана 

>> >>> >>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > This HAS to be the weirdest email | һауе had in а 


> while. 
>> 


>>>>>>>>> 

> > > > > > > > > ----- Oriai - 
2221-21 

> Ша rc B n, 

>>>> t: Friday, August 04, 2000 2:10 АМ 


e: Is this a real email address?? 


>>>>>>>>>То navistar.com 

>>> >>> >>> SU 5 a real email address?? 
>>>>>>>>> 

>>>>>>>>> If this is а real address please respond... 


>>>>>>>>> 

>> >>> >> >> 

>> >>> рр > р 

>>>>>>>>> 

> >>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmith.com 

> > > > > > > > > "We are the master Internet Craftsmen" 
> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 

>>>>>>>> 

>>>>>>>>-.. 

>>>>>>>> 

>>>>>>> 

>>>>>>> 

>>>>>>> 

»»»2»5»2»2WNW.Sütesmiüth.com 

> > > > > > > > "We are the master Internet Craftsmen" 
> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 

>>>>>>> 

> > > > > > > -- 

>>>>>>> 

>>>>>> 

>>>>>> 
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> > > > > > > www.sitesmith.com 


> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
>>>>>>-- 
>>>>>> 
>>>» 2222. 
>>>>>> 

>>>>>> 

> > > > > > www.sitesmith.com 


> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 


>>> >> 
> > > > > -- 


>> >>> umm 


>> >>> 


> >>> 
> >>> 
>> > > > wwwssitesmith.com 


> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 

>> >> 

> > > > -- 

>> >> 


> > > > 


>>> 
>>> 
> > > > www.sitesmiin.com 


> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>>>> 

>>> 

> > > -- 

> > > 


> > 
> > 
> > 
>> 


> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

> > -- 

>> 

>> 

> 

> 

> > www.sitesmith.com 

> > "We аге the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

p- S 

> 

> 


> NEM 5 


> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 


@ 
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"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: @sitesmith.com] 
Sent: .36 PM 

To: 

Subject: Contacted by Level3 


X-Sieve: 
cmu-sieve 1.3 


Return- : 
sitesmith.com> 
Rec 


from mailbox.sca1.sitesmith.com (localhost 
by mailbox.sitesmith.com (Postfix) with 
Mon, 7 Aug 2000 14:00:35 -0700 
(PDT) 
Delivered-To: 
sitesmith.com 
Re : 
from zeus (unknown 


Ld by 
mailbox.sit i tfix) with ESMTP id 
| j ны ОО esa: Mon, 7 Aug 
2000 14:00:32 -0700 (PDT) 
Date: 


Mon, 7 Aug 2000 17:00:08 -0400 (EDT) 


@sitesmith.com> 


zeus.corp.sitesmith.com 


š sitesmith.com> 
Mess “TO: 


1.0 
Content-Type: 
TEXT/PLAIN; charset-US-ASCII 


Subject: 
(ЕЕ-- jaBu2000080400000088] БЕ: 


Sender: 
sitesmith.com 
Errors-To: 
@sitesmith.com 
Х-Майтап- 
1.1 
Precedence: 
bulk 
List-Id: 


.sitesmith.com» 


(Qmailbox.sca1.sitesmith.com 


8001 
X-Mozilla-Status2: 
00000000 
X-UIDL: 
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Hash: SHA1 


----- BEGIN РОР SIGNED MESSAGE----- 
Hash: SHA1 


we are in NYC, EST... 


but the source ip is now constantly changing...seems like a loop of 
ip's..so far we have traced most everything back to Ohio, but we are 
still 

researching the issue 


thank you 


ug 2000 14:49:12 -0600 
evel3.com 


Subject: RE: ABU2000080400000088] 

Please forward this back to us with the time zone your logs are in. 
Thank you, 

Level 3 Security Team 


- - -----Original Message----- 


log... 


AUG 4 00:23:19 6/1 16751 ACL-7: NO ACL rule match! Discarding packet 
AUG 4 00:23:19 6/1 16752 ACL-7: UDP  SrcPort: 137 DestPort: 137 
AUG 4 00:23:19 6/1 16753 ACL-7 

AUG 4 00:23:19 6/1 16754 ACL-7 

AUG 4 00:23:19 6/1 16755 ACL-7: 


AUG 4 00:23:19 6/1 16756 ACL-7: NO ACL rule match! Discarding packet 
AUG 4 00:23:19 6/1 16757 ACL-7: : 137 
AUG 4 00:23:20 6/1 16758 ACL-7: 

AUG 4 00:23:20 6/1 16759 ACL-7: 

AUG 4 00:23:20 6/1 16760 ACL-7: 

AUG 4 00:23:20 6/1 16761 ACL-7: NO ACL rule match! Discarding packet 


AUG 4 00:23:20 6/1 16762 ACL-7: ort: 137 
AUG 4 00:23:20 6/1 16763 ACL-7: 

AUG 4 00:23:20 6/1 16764 ACL-7: 

AUG 4 00:23:20 6/1 16765 ACL-7: 


AUG 4 00:23:20 6/1 16766 ACL-7: NO ACL rule match! Discarding packet 
36 


AUG 4 00:23:20 6/1 16767 ACL-7: : ort: 137 
AUG 4 00:23:20 6/1 16768 ACL-7 
AUG 4 00:23:20 6/1 16769 ACL-7 


AUG 4 00:23:20 6/1 16770 ACL-7: 


AUG 4 00:23:20 6/1 16771 ACL-7: NO ACL rule match! Discarding packet 


AUG 4 00:23:20 6/1 16772 ACL-7: ort: 137 
AUG 4 00:23:20 6/1 16773 ACL-7: 
AUG 4 00:23:20 6/1 16774 ACL-7: 


AUG 4 00:23:20 6/1 16775 ACL-7: 


AUG 4 00:23:20 6/1 16776 ACL-7: NO ACL rule match! Discarding packet 
AUG 4 00:23:20 6/1 16777 ACL-7; : 137 

AUG 4 00:23:20 6/1 16778 ACL-7 

AUG 4 00:23:20 6/1 16779 ACL-7 

AUG 4 00:23:20 6/1 16780 ACL-7: 


sitesmith.com b 6 


---—— BEGIN PGP SIGNATURE----- 
Version: PGPfreeware 5.0i for non-commercial use 
Charset: noconv 


iQA/AwUBOY8jIbvNQYiUgEg9EQLOJQCgqbUA45V/RvBf5dgas8QOIFS/YkYkAoJri 
XdSQtd/mlyQmTLQTXEVpIEYy 

=аі МУ 

- — END PGP SIGNATURE----- 


Version: PGPfreeware 5.0i for non-commercial use 
Charset: noconv 


iQA/AWUBOY8jW7vNQYIUgEg9EQJ1ZgCgolg0V7Z1jdcWIppHeAAFrtggXOkAoP5J 
JFIhNxL--HZeHj8jFTYNNhBUD 
=55v6 


ailing list 
mailbox.sca1.sitesmith.com 
p://mailbox.scat .sitesmith.com/mailman/lisntd | 


WWW.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: 
Sent: 
To: 
Subject: 


trying to turn the tables 


X-Sieve: 


cmu-sieve 1.3 


Return-Path: 
@nav-international.com> 
Кес 


from[ ^ ^ ^  Jnavistar.com (mail.navistar.com 
lL Jby malbox sitesmith.cam (Postfix) 
with ESMTP id : for | | 
[ — — — ]@sitesmith.com>; Tue, 8 Aug 2000 08:17:13 -0700 


(PDT) 
Received: 


sitesmith.com; Tue, 8 Aug 2000 10:18:55 CST 


Received: 
b istar.com with Internet Mail Service 
id ue, 08 
Aug 2000 10:18:52 -0500 
Content-return: 
allowed 
Date: 


Tue, 08 Aug 2000 10:18:49 -0500 


F. 
[— — Janaentematonaicom 
Subject: 


Follow-up 


To: 


La peeeinenlnai cone 
Message-ID: 


1.0 
X-Mailer: 
Internet Mail Service 1 
Content-type: 
multipart/alternative; 
boundary="---- = NextPart 001_01C0014B.F420D020" 
X-Mozilla-Status: 
9001 
X-Mozilla-Status2: 


00000000 


i Sn 


| | 
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| was finally able to take a look at my server last night and found some b7 С 
interesting entries in my http апа ftp logs..... 


It would appear that you, or someone from within your company, was 
repeatedly making http requests to my server from approximately 
1:30 am to 3:15pm EST on 8/4/00....about one every minute or so. 


The ftp log also has numerous connections from within your organization 
during the same time frame. 

There were zero entries for any outgoing requests from my box to 
anything affiliated with you. 


In other words, the logs are indicating that YOU were attacking MY 
server. 


I have included a couple of the multiple entries from the ftp 
log....perhaps you recognize the I.P.s? (or the user/password?) 


Obviously, ! am dealing with a mature professional here... 


@my.domaing.com, 8/4/00, 9:56:16, MSFTPSVC, 
373 My , , 0,0, [78] PASS, 
my.domaing.com, -, 


[=== co ш corp sitesmith com, 8/4/00, 12:52:05, 
: UR1, -, 883701, 0, 0, 0, 64, [79] closed, -, -, 
, ; 1^ ; 44, 287022, 0, 0, 
Шъ" 8/4/00, 3:43:59, MSFTPSVC, 
,- 0, 27, U, 0, 0, [62] PASS , lyour.dead@mydic.org, 


Let me reiterate from my first email to you, 


You have made some very serious accusations against me. | know for a 
fact that you have contacted others with these 

accusations. You have shown absolutely no professionalism, or 
intelligence for that matter. | expect you to either provide 

adequate proof that I or any of my equipment was involved іп any 
incident or issue a formal apology. | 


"m s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: Ly LL 
Sent: ursday, August 17, 2000 1:40 PM 


To: 

Subject: asking me if | recognize the IP's b6 
b7C 

X-Sieve: 


cmu-sieve 1.3 
Return-Path: 


[____@nev-interntional.com> 
Rece қ 


from С  havistar.com (mail.navistar.com 


by mailbox si Postfix) 
with ESMTP id for 
[ Bsitesmith.com»; Wed, 9 Aug 2000 10:12:12 -0700 
(PDT) 


Received: 


@navistar.com> for 
@sitesmith.com; Wed, 9 Aug 2000 12:14:04 CST 
Re 
jstar.com with Internet Mail Service 
Wed, 09 

Aug 2000 12:14:46 -0500 
Content-return: 

allowed 

Date: 
Wed, 09 Aug 2000 12:14:03 -0500 


Fr 
ا‎ 4⁄5 


Subject: 
To: 


ыш» 


Message-ID: 


1.0 
X-Mailer: 
Internet Mail Sevicd | 
Content-type: 
multipart/alternative; 
Бошпдагу-"---- = NextPart 001_01C00225.376F4B20" 
X-Mozilla-Status: 
8003 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


Did you recognize the IP/username/password from the log entries | sent 
you yesterday? 


M s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: Е fstesmith.com] 


Sent: 1:40 PM 
To: 

Subject: Me confirming they were our IP's 
X-Sieve: 


cmu-sieve 1.3 
Return-Path: 
sitesmith.com> 
Rece : 
from mailbox.sca1.sitesmith.com (localhost 


[ |. ]by mailbox.sitesmith.com (Postfix 
with ESMTP id ed, 9 Aug 2000 


10:32:44 -0700-(PDT) 


Delivered-To; 
шшш, |, 
Received: 
from sitesmith.com (unknown 1] 


by mailbox.sitesmi 
ed, 9 Aug 2000 10:32:40 
-0700 (PDT) 


Mes -ID: 
@sitesmith.com> 


Wed, 09 Aug 2000 13:34:39 -0400 


Ег 
X-Maller: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 


en 
MIME-Version: 
1.0 
Г] 
1 Remeron. 
ist Msitesmith.com>, 
wwfent.com 
erences: 


ontent-Type: 


text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
7bit 


Su 


Se 
sitesmith.com 


Errors- ТО: 
@sitesmith.com 
X-Mailman-Version: ` 
1.1 
Precedence: 
bulk 
List-Id: . 
ailbox.sca1.sitesmith.com> 
X-BeenThere: 
(mailbox.sca1.sitesmith.com 
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X-Mozilla-Status: 
8001 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


Yes, the ip entries were all us, but that doesn't mean we attacked your 
machines. The webpage that you had on front had a forever looping 
script, which is why it appeared as if we were hammering your site via 
http and the ftp logs were us logging in to your machine downloading all 


the hacker tools that were on your machine. The client that this has 
happened to will most likely contact you or you will be contacted by the 


FBI. It is up to the client. | still cannot release the client 

information to you, as it is under inverstigation currently. | would 
seriously look at the config on your box, and go thru all the logs and 
arvhive them... you are going to need it. 


(мов 


> 
> 


> Did you recognize the IP/username/password from the log entries | 
> sent you yesterday? 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


mailing list 
mailbox.sca1.sitesmith.com 


http://mailbox.sca1 Sitesmith.com/mailman/lisntd | 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: [ — — — — — Bsitesmith.com] 


Sent: , 2000 1:43 PM 
To: 
Subject: AGAIN 


X-Sieve: 
cmu-sieve 1.3 


Return- 2 
nav-international.com> 
Кес 


from| ^ паміѕќаг.сот (mail.navistar.com 


by mailbox.sitesmith.com (Postfix) 
With ESMTP id ڪڪ‎ СУАН 9 Aug 2000 13:34:02 
-0700 (PDT) i 
Received: 


from navistar.com 
C Jnavistar.com by navistar.com (PMDF 
pL: 


with ESMTP id 


Sa |. Wed, 9 Aug 2000 


Received: | 


р navistar.com with Internet Mail Service 
C je ed, 09 
ug 2000 15:36:30 -0500 


Content-return: 
allowed 
Date: 
Wed, 09 Aug 2000 15:35:44 -0500 
From: 
nav-international.com> 


sitesmithcom{ | 


Subject: 
RE: 


sprxspn3.spr.navistar.com> 


Internet Mail Service (5.5.2650.21) 
Content-type: 

multipart/alternative; 

роџпаагу="---- = NextPart 001 01С00241.64871СС0" 
X-Mozilla-Status: 

8013 
X-Mozilla-Status2: 

00000000 


| 2 


| Interesting that you would copy in people from wwfent.com. 1s it safe 
| to assume that this is your client? 


Е 
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Why you think it is so important to conceal ANY information about this 1 
didn't understand until now..... 

| was off-site when I received acallthat[ һаа called and 
informed my wife that my IP address was attacking one of his 

sites. Thinking that my box may have been compromised, | had it powered 
down immediately. | have attempted to cooperate with you to 

find out what happened and why. І have e-mailed you twice to find out 
what was going on at your end (type of attack..etc.) but you don't 

respond. 


Then finally you respond with the email below. 


From what you are saying, 

"The webpage that you had on front had a forever looping 
script, 

which is why it appeared as if we were hammering your 
site via http" 


INITIATED OR ATTACKED ANYTHING!!! 


"and the ftp logs were us logging in to your machine downloading 
all 

the hacker tools that were on your machine" 

So now you have "hacker tools" on YOUR machine...should | contact 
the FBI? BTW...the "hacker" tools you speak of were used to 

scan a domain len e) at the domain owner's 
request. 


Ultimately, there was NO attack!! THIS IS A PRIVATE UNPUBLISHED 
address designed for my personal use and if you or anyone 

else decides to connect to it that is your fault. That would 
explain why | told you in my previous email that | could find no entries 


indicating that anything was initiated from my LP. 
Unbelievable!!! Here | thought | had been compromised and my box was 
being used for some kind of distributed DOS (the only thing I 
could think of since | knew that no one was intentionally attacking 
anyone) and instead | find out it wasn't me at all. 


Since there are some new people in the conversation, | am attaching the 


complete email history of the incident, starting with your initial 
contact wit 


@sitesmith.com] 


Dwwfent.com 


Yes, the ip entries were all us, but that doesn't mean we attacked 
you 

machines. The webpage that you had on front had a forever looping 

script, which is why it appeared as if we were hammering your site 
via 

http and the ftp logs were us logging in to your machine 
downloading all 

the hacker tools that were on your machine. The client that this 
has 

happened to will most likely contact you or you will be contacted 


e i 


by the 
FBI. It is up to the client. I still cannot release the client 
information to you, as it is under inverstigation currently. | 
would 
seriously look at the config on your box, and go thru all the logs 
and 
arvhive them... you are going to need it. 


[ — oe: 


> 
> 


> Did you recognize the IP/username/password from the log entries 
| 
> sent you yesterday? 


Sent: ugust 08, 2000 11:19 AM 
To: itesmith.com' 

Cc: 

Subject: Follow-up 


ا 


I was finally able to take a look at my server last night and found 
some interesting entries in my http and ftp logs..... 


It would appear that you, or someone from within your company, was 
repeatedly making http requests to my server from 

approximately 1:30 am to 3:15pm EST on 8/4/00....about one every 
minute or so. 


The ftp log also has numerous connections from within your 
organization during the same time frame. 

There were zero entries for any outgoing requests from my box to 
anything affiliated with you. 


In other words, the logs are indicating that YOU were attacking MY 
server. 


| have included a couple of the multiple entries from the ftp 
log....perhaps you recognize the I.P.s? (or the user/password?) 


Obviously, I am dealing with a mature professional here... 


Ta eed an Corr 8/4/00, 9:56:16, MSFTPSVC, 
C =, Û, 30, 0, Û, 0, [78] PASS, 


[  Bmy.domaing.com, " 


саас сор ео 8/4100, 12:52:05, 
M я 1, -, 883701, 0, 0, 0, 64, [79] closed 


siscom.net, 8/4/00, 
3:50:30, MSFTPSVC, COMANDURT1, -, 29643, 44, 287022, 
0, 0, [61] 


@mydic.org, 8/4/00, 3:43:59, MSFTPSVC, 
COMANDUR1, -, 0, 27, 0, 0, 0, [62] PASS, 
mydic.org, -, ` 
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Let me reiterate from my first email to you, 


You have made some very serious accusations against me. 1 know for 
a fact that you have contacted others with these 

accusations. You have shown absolutely no professionalism, or 
intelligence for that matter. | expect you to either 

provide adequate proof that | or any of my equipment was involved 
in any incident or issue a formal apology. 


[ | 


gust 07, 2000 4:30 PM 
itesmith.com' 


Бк 


Му name is and | am the owner of 
comandur.co iscom.net. 

[ — — ]forwarded this conversation between you and him to me... 
For clarification: | received a message from [ ^ Jon Friday 
August 5th around 3:15pm that my IP address was "attacking" a site 
maintained by sitesmith.com. Since | was away from the site at the time 
and unable to verify this information, | had someone disconnect 
the server at approximately 3:20pm and attempted to return [ ^ еа, 


however he was not at his phone. Since then, | have left the 
server down so that 1 can determine if it has been compromised. 


Jump to today: forwards this email to me and as | read 
through it 1 a letely confused as to what you are trying to say. 
You state mal | email is plastered all over the "hacked" web sites 

You say that the site has been hacked...you say that 

iscom.net is hacked and that the co ised box attacked your 
client when you emailed ^ ].you say та piscem net has 
hacked ndur.com...you say that comandur.com is the hacker and they 
hacked| 2 biscom net... 


All of these statements are either utterly ridiculous or completely 
wrong. (or both) 


1 know for a fact that no one wi wingly or intentionally "attacking" 
ANY sites from comandur.co iscom.net/209.251.13.206. 


| am more than willing to assist you if | can, however, | need more 
information than what you have provided so far. What was the nature of 
the attack? What sites were being attacked? How long did the attack 
last? etc... 


You are making some very serious accusations and have provided no proof 
to substantiate them. 


| 
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----- Original Message----- 

E N E 

Sent Monday, August 07, 2000 2:58 PM 

To: 

Subject: FW: Is this a real email address?? 


----- Original Message----- 
Frome 

белу: Monday. Auaust 07, 2000 12:27 PM 
To: 


Subject: RE: Is this a real email address?? 


idle threats now... | like. Please refrain from emailing me again 

unless 1), its from your attorney. -or- 2), your willing to provide 

details, 

such as "Who got hacked" "When?" "From who?" "| got your email address 
from a hacked site" (which obviously you didnt, as you already 

said you got it from www.1115.net) "Why you think they were hacked" 
"Some sort of proof" "Proof you have a clue" (most important.) "And 
anything you can think of" 


Thank You 


[x] 


P.S. If your that worried about your security that you wont provide any 
of these details, follow these instructions: 

1. Unplug the computer from the network. 

2. Shoot yourself in the head. 


I@sitesmith.com] 


котоп is hacked and the person that compromised this box 
attacked my client when | emailed you. | am going to need records of who 


that domain belongs to and if you are not willing to cooperate, the FBI 
may be involved. 


LO wrote: 


> 
> 
siscom.net was NOT hacked by comandur.com. iscom.net IS 
> comandur.com. 
> 


> Thank you. :) 
> 


> 
> The site that was hacked wa{ соте the reason l link you to 
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> 


> it is because you a ф hacker, which means you must 
> have his info. 


2 


{ wrote: 


> 


>> 
>> 
> > You can link me to being ^ because i am.. 


>> 


> > How you can link me to the compromised site, i have no clue. | dont 


> > know which site is being hacked or was hacked. 
>> 


>> 

> > Well, it would be nice to know why | was able to link your name to 
> > both 

> > the compromised site (which | can confirm is compromised....ftp in 
> as 


> > anonymous and fell me what you see) and you beng — j] 


>> 
4 Мов: 

>> 

>>> 

>>> 

> > > Oh.. i see, If there is anything you need from me, let me know. 
>>> 


>>> Em stesminconi 


> > > Subject: Re: Is this a real email address?? 


> > > uh, yeah except the motherfucker is hacking my site. 
> > > 


>>> 

>>>> 

>>>> 

> > > > correct.. | just do DNS for comandur.com, whatever content is on 


> 

> > the 

>>> 

> > > > page is his own fault.. 

>> >> 

> > > > afai — biscom.net == comandur.com.. so nothing unusual is 
> > going 

>>> 

> > > > on here. 

>> >> 


> > > > Subject: Re: Is this a real email address?? 
>>>> 


> > > > Sorry to leave you іп the dark. comandur.com 15 the hacker, and 
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> 


> > you 

>>> 

>>> Ра So | may need some help from you. The 
7 victim 

> > is 

>>> 

> > > > siscom.net ..... check ou iscom.net 

>> >> LF 

> >>> 

>> >>> 

>> >>> 

> > > > > Okay, everything was going good for my day, then you mention 
> > > this.. 

>>>>> 

> > > > > ... then withhold details, like "One of the 350 websites you 
> > host 

> > > > was 

> > > > > hacked" 

>>>>> 

> > > > > eluding to 1115.net as the site that was hacked.. but yet i 

> can 

> > > find 

>>>> 

> > > > > no signs anywhere... 

>> >>> 

> > > > > lf you would be so kind, please email me a link to a hacked 
> > page, 

> > > $0 

> >>> 


> > > > > some other proof.. This is driving me crazy. 
>> >>> 


>>>>> 


> > > > > From 
> > > > > Sent: 
>>> >> То 


> > > > > Subject: Re: Is this a real email address?? 
>>>>> 


> > > > > A site yu as hacked.... 

>>>>> 

>>>>> : 

>>>>>> 

>>>>>> 

> > > > > > which site was hacked? апа what makes you think it was 
> hacked? 

>> 

>>>>>> 

> > > > > > -----Oridi 
> > > > > > From 
> > > > > > Sent 
>> > > > > To: 
> > > > > > Subject: 
>>>>>> 

> > > > > > Apparently you didn't understand ту response. Your email is 
> > > > > plastered 

> > > > > > all over a website that was hacked, and more importantly, 


> you 


@sitesmith.com] 


Is areal email address?? 
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>> do 
>>> 
>>> 
>>> 


>>> 


> > > > > > this hacked website. 
>>> >>> 


>>> >>> 

>>>>>>> 

>>>>>>> 

> > > > > > > what makes you think that? 
>>> > >>> 

> > > > > > > -----Original Messaqe----- 
> > > > > > > From 
> > > > > > > Sent: 
>> >> >>> To 
> > > > > > > Subject: Re: Is this a real email.address?? 
>>>>>>> 

> > > > > > > Actually, | would like to be even more specific...... 1 
> got 

> > > your 

>>> > 

> > > > > > email 

>>>> >>> 


> > > > > > > address from a hacked website. 
>>>>>>> 


>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > Yes | do... get my email address from whois 
> information? 

>P> >>> >>> 

> > > > > > > > ----- Original Message----- 

> > > > > > > > From 
> > > > > > > > Sent: 
>> > > > > > > To: 
> > > > > > > > Subject: 
>>>>>>>> 

> > > > > > > > Let me ask you something.... .do уои һауе апу 

> affiliation 

> > > with 

>> >> 

>> > > > > > > 1115.net? 

>>>>>>>> 

>>>>>>>2----- rote: 

>>>>>>>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > This HAS to be the weirdest email | һауе had in a 
> while. 

>> 

>>>>>>>>> 

> > > > > > > > > ----- Original Messaqe----- 

> > > > > > > > > From: 


> 2222222 со 

> nt: Friday, August 04, 2000 2:10 AM 
< >> >>> >>> Tok 7; 

> > > > > > > > > Subject: 15 this a real email address?? 


>>>>>>>>> 

>>>>>>>>> If this is а real address please respond... 
>>>>>>>>> 

>>>>>>>>>-- 


Is а real email address?? 


sitesmith.com] 


>>>>>>>>> b7C 
Sao 55555 uu = 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmith.com 

> > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 


>>>>>>>> 
>>>>>>>>-. 

>>>>>>>> 

>>>>>>> 

>>>>>>> 

>>>>>>> 

>>>>>>> .Sitesmitni.com 

> > > > > > > > "We аге the master Internet Craftsmen" 
> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> I 
>>>>>>> 

>>>>>>>-- 

>>>>>>> 

>>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.silesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 

>>>>>>-. 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 

>>>>>-- 

>>>>> 

>>>>> 

>>> > 

>>> > 

> > > > > www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 


> >>> 

>>>>-- 

>>>> 

>>>> 

>>>> 

>>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>>> 


>>> 
> > > -- 
>>> 
>>> 
>> 


>> 


> > > www.sitesmith.com 
> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

> > -- f 
>> b6 
Е D e D EE Ep i —ra= b7c 
> 

> 

> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
> -- 
> 
> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


Sent: 
To: 
Subject: ist of tools ad on his machine 


From: sitesmith.com] b 7C 
744 PM 


total 38403 

drwxr-xr-x 2 root root 2048 Aug 9 17:11. 

drwxr-x--- 26 root root 3072 Aug 6 14:22 .. 

-rw-r--r-- root root 8334 Aug 4 03:07 
209.251.13.207.html 

-rw-r--r-- 1 root root 268800 Aug 4 03:39 Cokegift. VIR 
-rw-r--r-- (root root 2649619 Aug 4 03:43 Cool3D.exe 
-IW-r-r-- 1 root root 717205 Aug 4 03:58 Fat32.exe 
-W-r-r- 1 root root 181760 Aug 4 04:07 ICQ IP 
Sniffer.exe 

-rw-r--r-- 1 root root 917 Aug 4 03:20 Important.txt 
-IW-r-r-- 1 root root 3841189 Aug 4 04:14 

JDK-1 0 2-win32-x86.exe 

-rw-r--r-- 1root root 3956604 Aug 4 05:28 
PGPfreeware553(1).exe 


-rw-r--r-- 1 root root 169 Aug 4 03:20 README.txt 
-rw-r--r-- 1 root root 2048 Aug 4 05:54 SAFE.ZIP 
-tw-r--r-- 1 root root 51536 Aug 4 05:54 SilkRope.zip 
-rw-r--r-- [root root 95995 Aug 4 03:13 Spinrite 5.0.zip 


-rw-r--r-- 1root root 1299587 Aug 4 03:22 WebCrack40.zip 
-rw-r--r-- 1 root root 1853312 Aug 4 02:45 
accessdiver v2 92.zip 

-rw-r-r-- 1root root 3527468 Aug 4 03:20 ad3.zip 
-tw-r--r-- 1 root root 284421 Aug 4 03:33 backorifice. VIR 
-rw-r--r-- 1 root root 8393 Aug 4 03:33 bug.zip 

-fw-r--r-- 1 root root 16760 Aug 4 03:33 

c2myazz logon downgrade attack.zip 

-IW-I---- 1root root 2999427 Aug 4 03:38 cabdomscan.zip 
-rw-r--r-- 1 root root 569 Aug 4 03:20 color.txt 

-rw-r--r-- 1 root root 183401 Aug 4 03:23 crowcage.jpg 
-rw-r--r-- (root root 183839 Aug 4 02:45 d9813702.exe 
-rw-r--r-- [root root 298508 Aug 4 02:46 dd98137.exe 
-rw-r--r-- 1 root root 340922 Aug 4 02:46 del audio.exe 
-rw-r--r-- 1 root root 81739 Aug 4 03:23 diva.jpg 

-tw-r--r-- root root 84495 Aug 4 03:26 dolphin.jpg | 
-tw-r--r-- 1 root root 6358409 Aug 4 03:54 dreamweaver.exe 
-rw-r--r-- 1 root root 269239 Aug 4 03:27 estuary.jpg 
-rw-r--r-- root root 226938 Aug 4 03:27 fairypet.jpg 
-rw-r--r-- 1 root root 111586 Aug 4 04:01 fgwnbeta.zip 
-rw-r--r-- 1 root root 139645 Aug 4 03:28 fighter.jpg 
-rw-r--r-- 1 root root 0 Aug 9 17:11 filelist 

-rw-r--r-- root root 161100 Aug 4 04:01 fu.wav 

-rw-r--r-- 1 root root 469069 Aug 4 03:28 gardenpath.jpg 
-rw-r--r-- (root root 33069 Aug 4 04:02 getadmin.zip 
-rw-r--r-- 1 root root 250406 Aug 4 04:03 
haktek_network_tool.zip 

-tw-r--r-- 41root root 87649 Aug 4 04:08 icqipsniffer.zip 


-rw-r--r-- root root 967 Aug 4 03:20 mem.txt 
-IW-r--r-- 1 root root 139593 Aug 4 04:37 muerte.zip 
-rw-r--r-- 1root root 967199 Aug 4 04:40 natiObin.zip 
-rw-r--r-- 1 root root 518063 Aug 4 04:42 netbus153.VIR 
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-IW-r--r-- [root root 50454 Aug 4 02:52 netkit.tgz 
-rw-r--r-- root root 53414 Aug 4 02:52 netkit1.tgz 
-rW-r--r-- 1root root 247214 Aug 4 02:52 netkit2.tgz 
-IW-I---- 1root root 190648 Aug 4 02:53 netmap1.tgz 
-IW-r---- 1root root 82156 Aug 4 02:55 netmap2.tgz 
-rw-r--r-- 1 root root 278498 Aug 4 02:55 netmon1.tgz 
-rw-r--r-- 1 root root 159475 Aug 4 02:56 netmon2.tgz 
-lw-r--r-- 1 root root 40356 Aug 4 02:56 netmon3.tgz 
-rw-r--r-- 1 root root 78371 Aug 4 02:56 netmon4.tgz 
-rW-r--r-- 1 root root 32554 Aug 4 04:42 ntfsdos.zip 
-rw-r--r-- 1 root root 5120 Aug 4 05:02 nuke.exe 
-rw-r--r-- 1 root root 1497924 Aug 4 05:04 ogre2.zip 
-TW------- 1root root 2270 Jul 19 08:05 passwd.cdb 
-rw-r--r-- 1 root root 82394 Aug 4 03:29 planetonyx.jpg 
-rw-r--r-- 1 root root 1325 Aug 4 03:20 pop.txt 
-rw-r--r-- 1 root root 1080656 Aug 4 03:06 priceless.exe 
-rw-r--r-- 1 root root 280425 Aug 4 03:29 roomview.jpg 
-Ім/-г--Г-- 1 root root 23536 Aug 4 03:29 
sandstonecave.gif 

-IW-r--r-- 1root root 387177 Aug 4 03:30 
sandstonecave jpg 

-rw-r--r-- (root root 36920 Aug 4 05:53 sechole2.zip 
-IW-I--r-- {root root 768581 Aug 4 03:09 serials9840.zip 
-IW-I---- 1 root root 6975 Aug 4 03:31 skyscraper.him 
-IW-r--r-- 1 root root 287022 Aug 4 03:31 skyscraper.jpg 
-IW-r--r-- 1 root root 276632 Aug 4 05:53 
smbscanner-eng.zip 

-rw-r--r-- root root 212414 Aug 4 02:56 
sniffit.0.3.7.beta.tar.gz 

-rw-r--r-- 1 root root 44510 Aug 4 02:57 snmpsniff-1_0.gz 


-rw-r--r-- 1 root root 10191 Aug 4 02:57 spoof.0.1.tar.gz 


-rw-r--r-- 1 root root 190851 Aug 4 03:10 wwwhack.zip 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: @sitesmith.com] 
Sent: ursday, August 1/, :45 PM 

To: 

Subject: e showing the list of tools 
X-Sieve: 


cmu-sieve 1.3 
Return-Path: 
sitesmith.com> 


Re н 
from mailbox.sca1.sitesmith.com (localhost 


[| by mailbox.sitesmith.com (Posti 
with ESMTP id ed, 9 Aug 2000 


14:14:28 -0700 (PDT) 
Delivered-To: 


[  Bsitesmith.com 


Received: 
from sitesmith.com (unknown | 


Бу mailbox.sitesmith.com 


ESMTP id Wed, 9 Aug 2000 14:14:24 
-0700 (PDT) 
Message-ID: 
SL oo enne 
Date: 
Wed, 09 Aug 2000 17:16:24 -0400 
From: 
[ —— —— — @sitesmith.com> 
X-Mailer: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 
To: 


| preces 
C: 


" navistar.com>, 
int-wwf List sitesmith.com>, 
wwfent.com 
References: 


Po Disprspnà.spr.navistar.com» 


Content-Type: 
text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 
Subiect: 


sitesmith.com 
Err 
@sitesmith.com 
X-Mailman-Version: 

1.1 

Precedence: 
bulk 
List-Id: 
«int-wwf.mailbox.sca1.sitesmith.com» 
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s UU ee eee = ey ee ate, 


X-Bee 2 
mailbox.sca1.sitesmith.com 
X-Mozilla= : 


8001 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


Well, | guess you caught me trying to break in to your machines.... NOT. 


These tools are what you use to scan a domain? Here is a list of the 
tools we took from your machine and yes we have proof they came from 
your machine. 


drwxr-xr-x 2root root 2048 Aug 9 17:11. 

drwxr-x--- 26 root root 3072 Aug 6 14:22 .. 

-rw-r--r-- 1 root root 8334 Aug 4 03:07 
209.251.13.207.html 

-rw-r--r-- 1 root root 268800 Aug 4 03:39 Cokegift. VIR 
-rw-r--r-- 1root root 2649619 Aug 4 03:43 Cool3D.exe 
-rw-r--r-- 1 root root 717205 Aug 4 03:58 Fat32.exe 
-IW-I--r-- 1 root root 181760 Aug 4 04:07 ICQ IP 
Sniffer.exe 

-rw-r--r-- 1 root root 917 Aug 4 03:20 Important.txt 
-rw-r--r-- 1root root 3841189 Aug 4 04:14 

JDK-1 0 2-win32-x86.exe 

-rw-r--r-- root root 3956604 Aug 4 05:28 
PGPfreeware553(1).exe 


-rw-r--r-- 1 root root 169 Aug 4 03:20 README.txt 
-IW-r--r-- (root root 2048 Aug 4 05:54 SAFE.ZIP 
-rw-r--r-- 1 root root 51536 Aug 4 05:54 SilkRope.zip 
-rw-r--r-- 1 root root 95995 Aug 4 03:13 Spinrite 5.0.zip 


-rw-r--r-- 1 root root 1299587 Aug 4 03:22 WebCrack40.zip 
-rW-r-r-- (root root 1853312 Aug 4 02:45 
accessdiver v2 92.zip 

-rw-r--r-- root root 3527468 Aug 4 03:20 ad3.zip 
-rw-r--r-- 1 root root 284421 Aug 4 03:33 backorifice.VIR 
-rw-r--r-- 1 root root 8393 Aug 4 03:33 bug.zip 

-rw-r--r-- 1root root 16760 Aug 4 03:33 
c2myazz_logon_downgrade_attack.zip 

-rw-r--r-- 1 root root 2999427 Aug 4 03:38 cabdomscan.zip 
-tw-r--r-- 1root root 569 Aug 4 03:20 color.txt 

-rw-r--r-- 1 root root 183401 Aug 4 03:23 crowcage.jpg 
-rw-r--r-- 1 root root 183839 Aug 4 02:45 d9813702.exe 
-rw-r--r-- 1 root root 298508 Aug 4 02:46 dd98137.exe 
-Tw-r--r-- 1 root root 340922 Aug 4 02:46 del_audio.exe 
-rw-r--r-- 1 root root 81739 Aug 4 03:23 diva.jpg 

-rw-r--r-- 1root root 84495 Aug 4 03:26 dolphin.jpg 
-rw-r--r-- 1 root root 6358409 Aug 4 03:54 dreamweaver.exe 
-rw-r--r-- 1 root root 269239 Aug 4 03:27 estuary.jpg 
-'W-r---- 1root root 226938 Aug 4 03:27 fairypetjpg 
-rw-r--r-- 1 root root 111586 Aug 4 04:01 fgwnbeta.zip 
-rw-r--r-- 1 root root 139645 Aug 4 03:28 fighter.jpg 
-rw-r--r-- root root 0 Aug 9 17:11 filelist 

-rw-r--r-- 1 root root 161100 Aug 4 04:01 fu.wav 

-rw-r--r-- 1 root root 469069 Aug 4 03:28 gardenpath.jpg 
-rw-r--r-- 1root root 33069 Aug 4 04:02 getadmin.zip 
-rw-r--r-- 1 root root 250406 Aug 4 04:03 
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haktek network tool.zip 
-rw-r--r-- 1 root root 87649 Aug 4 04:08 icqipsniffer.zip 


-rw-r--r-- 1 root root 967 Aug 4 03:20 mem.txt 
-rw-r--r-- 1 root root 139593 Aug 4 04:37 muerte.zip 
-rW-I--r-- 1root root 967199 Aug 4 04:40 nat10bin.zip 
-rw-r--r-- 1 root root 518063 Aug 4 04:42 netbus153.VIR 
-tw-r--r-- 1 root root 50454 Aug 4 02:52 netkit.tgz 
-tw-r--r-- 1 root root 53414 Aug 4 02:52 netkit1.tgz 
-rw-r--r-- (root root 247214 Aug 4 02:52 netkit2.tgz 
-rw-r--r-- 1 root root 190648 Aug 4 02:53 netmap1.tgz 
-IW-r--r- {root root 82156 Aug 4 02:55 netmap2.tgz 
-rw-r--r-- 1 root root 278498 Aug 4 02:55 netmon1.tgz 
-tw-r--r-- 1 root root 159475 Aug 4 02:56 netmon2.tgz 
-IW-r--r-- 1 root root 40356 Aug 4 02:56 netmon3.tgz 
-rw-r--r-- 1 root root 78371 Aug 4 02:56 netmon4.tgz 
-rw-r--r-- 1 root root 32554 Aug 4 04:42 ntfsdos.zip 
-rw-r--r-- root root 5120 Aug 4 05:02 nuke.exe 
-rw-r--r-- 1 root root 1497924 Aug 4 05:04 ogre2.zip 
TW------- 1root root 2270 Jul 19 08:05 passwd.cdb 
-Tw-r--r-- 1 root root 82394 Aug 4 03:29 planetonyx.jpg 
-rw-r--r-- 1 root root 1325 Aug 4 03:20 pop.txt 
-rw-r--r-- 1 root root 1080656 Aug 4 03:06 priceless.exe 
-rw-r--r-- 1 root root 280425 Aug 4 03:29 roomview.jpg 
-rw-r--r-- 1 root root 23536 Aug 4 03:29 
sandstonecave.gif 

-CIW-r--r-- 1root root 387177 Aug 4 03:30 
sandstonecave.jpg 

-rw-r--r-- 1 root root 36920 Aug 4 05:53 sechole2.zip 
-rw-r--r-- 1 root root 768581 Aug 4 03:09 serials9840.zip 
-rw-r--r-- 1 root root 6975 Aug 4 03:31 skyscraper.htm 
-rw-r--r-- 1 root root 287022 Aug 4 03:31 skyscraper jpg 
-rw-r--r-- 1 root root 276632 Aug 4 05:53 
smbscanner-eng.zip 

-rw-r--r-- 1root root 212414 Aug 4 02:56 
sniffit.0.3.7.beta.tar.gz 

-rw-r--r-- 1 root root 44510 Aug 4 02:57 snmpsniff-1_0.gz 


-rw-r--r-- 1 root root 10191 Aug 4 02:57 spoof.0.1.tar.gz 
-rw-r--r-- 1 root root 190851 Aug 4 03:10 wwwhack.zip 

Not only are 90% of these tools used ONLY for malicious purpose, but you 
didn't even write them yourself, which qualifies you as a script kiddie. 
When the FBI busts you...you're welcome. 


> 
> 


> Interesting that you would copy in people from wwfent.com. Is it safe 


> to assume that this is your client? 
> Why you think it is so important to conceal ANY information about this 


> | didn't understand until now..... 

> | was off-site when l received a call ваГ аа called 

> and informed my wife that my IP address was attacking one of his 

> sites. Thinking that my box may have been compromised, | had it 

> powered down immediately. | have attempted to cooperate with you to 
> find out what happened and why. | have e-mailed you twice to find out 


59 


> what was going on at your end (type of attack..etc.) but you don't 
> respond. 
> 


> Then finally you respond with the email below. 
> 


> From what you are saying, 


> "The webpage that you had on front had a forever looping 
> script, 
> which is why it appeared as if we were hammering your 


> site via http" 

> YOUR client initiated a connection to MY site!!!!!!! MY SITE NEVER 
> INITIATED OR ATTACKED ANYTHING!!! 

> 2 

> 

> "and the ftp logs were us logging in to your machine downloading 


> all 
> {һе hacker tools that were on your machine" 
> Зо now you have "hacker tools" on YOUR machine...should | contact 


v 


the FBI? BTW...the "hacker" tools you speak of were used to scan 


a domai ^ O O O O] at the domain owner's 


request. 


Ultimately, there was NO attack!! THIS IS A PRIVATE UNPUBLISHED 
address designed for my personal use and if you or anyone else 
decides to connect to it that is your fault. That would explain 

why I told you in my previous email that | could find no entries 
indicating that anything was initiated from my І.Р. 


VVVVVVVV 


> 
> Unbelievable!!! Here | thought | had been compromised and my box was 
> being used for some kind of distributed DOS (the only thing | could 

> think of since І knew that no one was intentionally attacking 

> anyone) and instead | find out it wasn't me at all. 

> 

> Since there are some new people in the conversation, | am attaching 

> the complete email history of the incident, starting with your initial 


> contact with m ] 
> 


> 
> 

> 

> --- Original Message----- 

> From: @sitesmith.com] 

> Sent 

> To: @wwfent.com 

> Subject: Re: 

> 

> Yes, the ip entries were all us, but that doesn't mean we 

> attacked you 

> machines. The webpage that you had on front had a forever looping 
> 

> script, which is why it appeared as if we were hammering your 

> Site via 

> http and the ftp logs were us logging in to your machine 

> downloading all 

> һе hacker tools that were on your machine. The client that this 

> has 

> happened to will most likely contact you or you will be contacted 
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> sent you yesterday? 


>  bythe 

> FBI. It is up to the client. | still cannot release the client b6 
> information to you, as it is under inverstigation currently. | b7C 
> would 

> seriouslylook at the config on your box, and go thru all the 

> logs and 

>  arvhive them... you are going to need it. 

> 

>l roe: 

> 

> > 

> > 

> > Did you recognize the IP/username/password from the log 

> entries! 

> 

> 

> 

> 
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From: 


Sent: gust 08, 2000 11:19 AM 
To: sitesmith.com' 

Cc: 

Subject: Follow-up 


[ |] 


| was finally able to take a look at my server last night and 
found some interesting entries in my http and ftp logs..... 


It would appear that you, or someone from within your company, 
was repeatedly making http requests to my server from 
approximately 1:30 am to 3:15pm EST on 8/4/00....about one every 
minute or so. 


The ftp log also has numerous connections from within your 
organization during the same time frame. 

There were zero entries for any outgoing requests from my box to 
anything affiliated with you. 


In other words, the logs are indicating that YOU were attacking 
MY server. 


I have included a couple of the multiple entries from the ftp 
log....perhaps you recognize the I.P.s? (or the user/password?) 


Obviously, | am dealing with a mature professional here... 
@my.domaing.com, 8/4/00, 9:56:16, 
MSETPSVC, COMANDURT, -, 0, 30, 0, 0, 0, [78] PASS, 
my.domaing.com, -, 


lL ]@zeus.corp.sitesmith.com, 8/4/00, 12:52:05, 
MSFTPSVC, СОМАМООК1, -, 883701, 0, 0, 0, 64, [79] closed, -, -, 


VVVVVVVVVVV VV VV VV VV VV VV VV VV VV VV VV VV 


v 


siscom.net, 
, 29643, 44, 287022, 0, 0, 


v v 
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L onno core, 8/4/00, 3:43:59, MSFTPSVC, 
, x, U, ZT, U, 0, 0, [62] PASS mydic.org, 
@ * 


VVVVV 


1 


Let me reiterate from my first email to you, 


You have made some very serious accusations against me. | know 
for a fact that you have contacted others with these 

accusations. You have shown absolutely no professionalism, or 
intelligence for that matter. | expect you to either provide 

adequate proof that | or any of my equipment was involved in any 
incident or issue a formal apology. 


[ | 


> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 


v 


VVVVVVVV 


> My name if ^ Һа | am the owner of 


— | i о .het. 
forwarded this conversation between you and him to me.. 


> For clarification: | received a message from| фп Friday 


> August 5th around 3:15pm that my IP address was "attacking" a site 

> maintained by sitesmith.com. Since | was away from the site at the 

7 time and unable to verify this information, | had someone TEE 

> the server at approximately 3:20pm and attempted to returni 

> call, however he was not at his phone. Since then, | have left the 

> server down so that I can determine if it has been compromised. 

> 

> Jump to toda forwards this email to me and as l read 

> through it | am completely confused as to what you are trying to say. 

> You state ta pmo is plastered all over the "hacked" web 

> si age. You say that the site has been hacked...you say that 
иш is hacke d that the compromised box attacked your 
> client when you emailed ...you say tha siscom.net has hacked 
> comandur.com...you say that comandur.com is the hacker and they hacked 


| рәтле... 


> All of these statements are either utterly ridiculous or completely 
> wrong. (or both) 
> 


> | know for a fact that no one was knowingly or intentionally 
> "attacking" ANY sites from 

> comandur.co iscom.net/209.251.13.206. 

2 T P 


> | am more than willing to assist you if | can, however, | need more 

> information than what you have provided so far. What was the nature 
> of the attack? What sites were being attacked? How long did the 

> attack last? etc... 

> 

> You are making some very serious accusations and have provided no 
> proof to substantiate them. 

> 

> 


„| А 
Ф 


irom — c] 


> Sent: 000 2:58 PM 
> To: 
> Subject: : Is this à real email address?? 


>To 


> Subject: RE: Is this a real email address?? 

> 

> idle threats now... I like. Please refrain from emailing me again 

> unless 1), its from your attorney. -or- 2), your willing to provide 

> details, such as "Who got hacked" "When?" "From who?" "I got your 

» email address from a hacked site" (which obviously you didnt, as you 

> already said you got it from www.1115.net) "Why you think they were 

> hacked" "Some sort of proof" "Proof you have a clue" (most important.) 


> "And anything you can think of" 
> 


> Thank You 


ا 


> P.S. If your that worried about your security that you wont provide 
> any of these details, follow these instructions: 

> 1. Unplug the computer from the network. 

> 2. Shoot yourself in the head. 


> Subject: Re: Is this a real email address?? 

> 

[ы арен is hacked апа the person that compromised this box 
ed my client when | emailed you. | am going to need records of 


> who 
» that domain belongs to and if you are not willing to cooperate, the 
> ЕВ! 


> may be involved. 
> 


x wrote: 

> 

>> 

>> 

>] ]siscom.net was NOT hacked by comandur.com iscom.net IS 
> > comandur.com. 

>> 

> > Thank you. :) 


> > Subject: Re: Is this a real email address?? 

>> 

> > The site that was hacked wa[ þiscom.net, the reason l link you 
> to 

>> 


> > itis because you ad P hacker, which means you 
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> must 
> > have his info. 


>> 


44 hote: 


>> 
>>> 


>>> 
> > > You can link me to bend Î because i am.. 


>>> 
> > > How you can link me to the compromised site, i have no clue. 1 
> dont 


> > > know which site is being hacked or was hacked. 
>>> 


> > > Subject: Re: Is this-a-real email address?? 
>>> 


> > > Well, it would be nice to know why l was able to link your name to 


> 
> > > both | 
> > > the compromised site (which | can confirm is compromised....ftp in 


> 
> > as 


> > > anonymous and tell me what you see) and you being j] 
>>> 


>>> 
>> >> 
> >>> 


> > > > Oh.. i see, If there is anything you need from me, let me know. 
>> >> 


>>> > From sitesmith.com] 
> > > > Sent: Friday, August 04, 2000 1:44 PM 

> > >> To 

> > > > Subject: Re: Is this a real email address?? 

>> >> 


> > > > uh, yeah except the motherfucker is hacking my site. 
> >>> 


> >>> 
>> >>> 
>>>>> 


> > > > > correct.. ljus — bomandur.com, whatever content is 
>on 


> > > > > page is his own fault.. 
>> >>> 


> > > > > afaik| ^ biscom.net == comandur.com.. so nothing unusual is 


> 
> > > going 
>>>> 


> > > > > on here. 
>>>>> 


> > > > > ----- Original Меѕѕаае----- 
> > > > > From @sitesmith.com] 
> > > > > Sent: ; я : 


© : 


- бу 


>> >>> To 


> > > > > Subject: Re: Is this a real email address?? 

>>>>> 

> > > > > Sorry to leave you in the dark. comandur.com IS the hacker, 
> and 

>> 

> > > you 

>> >> 


>> >> Г" So | may need some help from you. The 
> > victi 


> > > is 
>>>> 


> > > > > siscom.net!..... check ou[ Jiscom.net 
>>>>> 


>>> rote: 
>>> >> 

>>>>>> 

>>>>>> 


> > > > > > Okay, everything was going good for my day, then you mention 


> 
> > > > this.. 
>>>>>> 


> > > > > > ... then withhold details, like "One of the 350 websites you 


> 

> > > host 
> > > > > was 

> > > > > > hacked" 

>>> >>> 

> > > > > > eluding to 1115.net as the site that was hacked.. but yet i 

> > can 

> > > > find 

>>>>> 

> > > > > > no signs anywhere... 

>>>>>> 

> > > > > > lf you would Бе so kind, please email me a link to a hacked 
> > > page, 

> > > > so 

>>> >> 

> > > > > > some other proof.. This is driving me crazy. 

>>>>>> 

> > > > > > Thank You 

>>> >>> 

>>>>>> 

> > > > > > Navistar International 

>>>>>> 

> > > > > > ----- OriainaLMessaqe----- 

> > > > > > From: 
> > > > > > Sent: 
>> >> >> T 


> > > > > > Subject: Re: Is this a real email address?? 
>>>>>> 


> > > > > > A site yop фа hacked.... 


>> >>>> 
>>>>>> wrote: 

>>> >>> 

>> >> >>> 

>> >>>>> 

> > > > > > > which site was hacked? and what makes you think it was 
> > hacked? 
>>> 
>>>>>>> 
>>>>>>> 
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> > > > > > > Fro 
> > > > > > > Sent! 
>> >> >>> To 
> > > > > > > Subject: Re: Is this a real email address?? 

>>>>>>> 

> > > > > > > Apparently you didn't understand my response. Your email 
>is 

> > > > > > plastered 


> > > > > > > all over a website that was hacked, and more importantly, 
>> 


>> 
>> 


>> >>> 


ы 
> > > > > > > this hacked website. 
>>>>>>> 


>>>>>>> 
>>>>>>>> 
>>>>>>>> 


> > > > > > > > what makes you think that? 
>>>>>>>> 


>>>>>>>> 

> > > > > > > > Actually, | would like to be even more specific...... | 
> > got 

> > > > your 

>> >>> 

> > > > > > > email 

>>>>>>>> 

> > > > > > > > address from а hacked website. 
>>>>>>> 

ССС та wrote: 

>>>>>>>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > Yes | do... get my email address from whois 


> > information? 
>>>>>>>>> 


>>>>>>>>> id SSE | 04, 2000 10:59 AM 
>>>>>>>>>Т 
> > > > > > > > > Subject: Ке: Is this a real email address?? 


>>>>>>>>> 

> > > > > > > > > Let me ask you something.... .do you have any 
> > affiliation 

> > > > with 

>> >>> 

>>> > >> >>> 1115.пеі? 

>>>>>>>>> 

>>>>>>>>>[  )мовғе: 

>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>>> 

> > > > > > > > > > This HAS to be the weirdest email | have had in a 
> > while. 

>>> 
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>>>>>>>>>> 


>>>>>>>>>>---- Original Messaqe----- 
> > > > > > > > > > From 


> Las sees huaman 
>>> > > > >>> > Sent Eri ugust 04, 2000 2:10 AM 


>> > > > > > > > > To 
> > > > > > > > > > Subject: Is 
>>>>>>>>>> 


Is а real email address?? 


>>>>>>>>>> If this is а real address please respond... 


>>>>>>>>>> 

>>>>>>>>>>.. 

>>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>>> 

> > > > > > > > > > www.sitesmith.com 

> > > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>>> 


>>>>>>>>> 

>>>>>>>>>-- 

>>>>>>>>> 

>>>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmith.com 

> > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 


>>>>>>>> 

>>>>>>>>-- 

>>>>>>>> 

>>>>>>>> 

>>>>>>> 

>>>>>>> 

>>>>>>>>Wwww.sitesmin.com 

> > > > > > > > "Weare the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 


>>>>>>> 

> > > > > > > -- 

>>>>>>> 

>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
> > > > > > -- 

>> >> >> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>> >>> 


>>>>> 
>>>>>-- 
>>>>> 
> > > > > 
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> > > > > www.sitesmith.com 


> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>>>>> 


>>>> 

>>>>-- 

>>>> 

>>>> 

>>>> 

>>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>> >> 

>>> 

> > > -- 

>>> 


>> 
>> 
>> 


> > > www.sitesmith.com 
> > > "We аге the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
> > -- 
> 


> 

> 

> 

> | 
> > www.sitesmitn.com 


> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 
>-- 
> 


> 


> www.sitesmitn.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


> 


-—əM— —  —— —.>——ə—————— b.>— < sn‏ سه 


ЖЕНЕ 5 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


ailing list 
mailbox.sca1.sitesmith.com 
p: máilbox.scat.sitesmith.com/mailman/istnti — | 
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BIC 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: La sitesmith.com} 


Sent: 00 1:48 PM 
To: 
Subject: ebuttal 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 
@nav-international.com> 
Received: 
e [ havistar.com (mail.navistar.com 
by mailbox.sitesmith.com (Postfix) 
ith ог 
C ЕТТЕ Thu, 10 Aug 2000 06:46:41 -0700 
(РОТ) 
Received: 
from i 
[ lnavistar.co by navistar.com (PMDF 
with ESMTP id 
navistar.com> for 
esmith.com; Thu, 10 Aug 2000 08:48:34 CST 


Received: 
b navistar.com with Internet Mail Service 
id hu, 10 

Aug 2000 08:48:31 -0500 

Content-return: 
allowed 

Date: 

Thu, 10 Aug 2000 08:48:28 -0500 


Ег 

lL Janevintemtonat om 
Subject: 

RE: 


Eo tnt com 
Message-ID: 


Cag pear com: 


1.0 


X-Mailer: 
Internet Mail Service | 
Content-type: 
multipart/alternative; 
boundary="----_= NextPart 001 01C002D1.A9DF0680" 
X-Mozilla-Status: 
8011 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


[ _ h el.. 
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You are clueless. Throughout this entire incident, whatever bits of 
information you have given has been wrong. Look back i the 


history of emails below. You started off by insinuating that 
[ies attacki ou. You couldn't grasp the concept that 


comandur.com | iscom.net. You boo oe 
comandur.com hacke iscom.net, ev explicitly 


informed you З times that comandur.com | iscom.net 


You lied about how you got his e-mail, stating that "it was plastered 
all over a hacked website"... You lied y web page having a 
"forever looping script"... Remember І have logs as well...if it 
is a "forever looping script", explain why within a 12 hour period there 


are gaps of anywhere from 1/2 hour to 3 hours and they came from at 
least 3 different subnets that sitesmith manages. Wouldn't a "forever 
looping script"..LOOP continually? 


Wouldn't a "forever looping script" loop on the same PC? 

What happens when you close your browser and any pop-up? IT STOPS 
LOOPING! 

As for the files on my ftp site: Bear this in mind, you have no clue 

who | am or what my job is, so let me give you а little іпіо....! am 
currently employed as a Protocol analyst for Navistar International. 

Part of my duties has been to provide security audits and identify 
vulnerabilities at our Ohio facilities. | also work on the side as a 

security consultant. Prior to that | was the System Admin for a local 

ISP, 

which included site security. The tools you took from my site are ones 
that | have used to perform these job functions as well as files that 

my colleagues have found and uploaded to my site. What better tools to 
check for vulnerabilities that "script kiddies" would find than the 

ones they would use. Do you know of any people who deal with security 
that DON'T have files like these? 


HOWEVER, | see the files on my site that you downloaded to be a moot 
point since none of them were deployed against you. 


Lastly, your continual threat of FBI involvement is missing the mark. 

In order for that to scare me, | must be guilty of something. 1 

welcome the chance to present my case along with the log files and your 
emails to show what a complete fool you are and how 

contradictory and completely mis-informed you have been and then seek 
restitution for the damages you have caused. 


Dsitesmith.com] 


@wwfent.com 


Well, | guess you caught me trying to break in to your machines... 
NOT. 

These tools are what you use to scan a domain? Here is a list of 
the 

tools we took from your machine and yes we have proof they came 
from 
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your machine. 


drwxr-xr-x 2root root 2048 Aug 9 17:11. 

drwxr-x--- 26root root 3072 Aug 6 14:22 .. 

-IW-r---- root root 8334 Aug 4 03:07 

209.251.13.207.html 

-rw-r--r-- 1root root 268800 Aug 4 03:39 
Cokegift. VIR 

-rw-r--r-- 1 root root 2649619 Aug 4 03:43 Cool3D.exe 

-rw-r--r-- {root root 717205 Aug 4 03:58 Fat32.exe 

-w-r--r-- 1 root root 181760 Aug 4 04:07 ICQ IP 

Sniffer.exe 

-rw-r--r-- 1 root root 917 Aug 4 03:20 
Important.txt 

-rw-r--r-- 1 гооі root 3841189 Aug 4 04:14 

JDK-1 0 2-win32-x86.exe 

-rw-r--r-- 1 root root 3956604 Aug 4 05:28 

PGPfreeware553(1).exe 


-rw-r--r-- 1 root root 169 Aug 4 03:20 README.txt 

-rw-r--r-- 1 root root 2048 Aug 4 05:54 SAFE.ZIP 

-rw-r--r-- 1root root 51536 Aug 4 05:54 
SilkRope.zip 

-rw-r--r-- 1root root 95995 Aug 4 03:13 Spinrite 
5.0.zip 


-rw-r--r-- 1 root root 1299587 Aug 4 03:22 
WebCrack40.zip 

-rw-r--r-- 1root root 1853312 Aug 4 02:45 

accessdiver_v2_92.zip 

-rw-r--r-- 1root root 3527468 Aug 4 03:20 ad3.zip 

-rw-r--r-- 1 root root 284421 Aug 4 03:33 
backorifice. VIR 

-tw-r--r-- 1 root root 8393 Aug 4 03:33 bug.zip 

-tw-r--r-- 1 root root 16760 Aug 4 03:33 

c2myazz_logon_downgrade_attack.zip 

-tw-r--r-- 1 root root 2999427 Aug 4 03:38 
cabdomscan.zip 

-rw-r--r-- 1 root root 569 Aug 4 03:20 color.txt 

-tw-r--r-- 1 root root 183401 Aug 4 03:23 
crowcage.jpg 

-tw-r--r-- 1 root root 183839 Aug 4 02:45 
d9813702.exe 

-rw-r--r-- 1 root root 298508 Aug 4 02:46 dd98137.exe 


-rW-r--r-- 1 root root 340922 Aug 4 02:46 
del_audio.exe 

-rw-r--r-- 1root root 81739 Aug 4 03:23 diva.jpg 

-rw-r--r-- 1 root root 84495 Aug 4 03:26 dolphin.jpg 


-IW-I--r-- 1root root 6358409 Aug 4 03:54 
dreamweaver.exe 
-rw-r--r-- 1 root root 269239 Aug 4 03:27 estuary.jpg 


-IW----- 1 root root 226938 Aug 4 03:27 
fairypet.jpg 

-rw-r--r-- 1 root root 111586 Aug 4 04:01 
fgwnbeta.zip 

-tw-r--r-- 1 root root 139645 Aug 4 03:28 fighter.jpg 


-tw-r--r-- 1 root root 0 Aug 9 17:11 filelist 
-rw-r--r-- 1 root root 161100 Aug 4 04:01 fu.wav 
-IW-r--r-- 1 root root 469069 Aug 4 03:28 
gardenpath.jpg 
e Í 


-rw-r--r-- 1 root root 
getadmin.zip 

-rw-r--r-- 1 root root 

haktek_network_tool.zip 

-rW-r--r-- 1 root root 
icqipsniffer.zip 

-rw-r--r-- (root root 

-rw-r--r-- 1root root 

-rw-r--r-- 1root root 
nat10bin.zip 

-rw-r--r-- 1 root root 
netbus153.VIR 

-rw-r--r-- 1root root 

-rw-r--r-- 1root root 

-rw-r--r-- lroot root 

-IW-r---- 1root root 

-rw-r--r-- 1 root root 

-rw-r--r-- 1 root root 

-rw-r--r-- 1 root root 

-rw-r--r-- [root root 

-IW-r--r- 1root root 

-rw-r--r-- 1 root root 

-rw-r--r-- 1root root 

-rw-r--r-- (root root 

-TW------- 1root root 

-IW-I--r-- 1 root root 
planetonyx.jpg 

-Tw-r--r-- 1root root 

-rw-r--r-- 1 root root 
priceless.exe 

-rw-r--r-- 1 root root 
roomview.jpg 

-lw-r--r-- 1 root root 

sandstonecave.gif 

-rw-r--r-- 1 root root 

sandstonecave.jpg 

-rw-r--r-- droot root 
sechole2.zip 

-rw-r--r-- 1 root root 
serials9840.zip 

-rw-r--r-- 1 root root 
skyscraper.htm 

-rw-r--r-- 1 root root 
skyscraper jpg 

-rw-r--r-- 1 root root 

smbscanner-eng.zip 

-rw-r--r-- 1 root root 

sniffit.O.3.7.beta.tar.gz 

-rw-r--r-- (root root 
snmpsniff-1 O.gz 

-rw-r--r-- 1root root 


spoof.0.1.tar.gz 


33069 Aug 4 04:02 


250406 Aug 4 04:03 
87649 Aug 4 04:08 

967 Aug 4 03:20 mem.txt 
139593 Aug 4 04:37 muerte.zip 
967199 Aug 4 04:40 
518063 Aug 4 04:42 


50454 Aug 4 02:52 netkit.tgz 
53414 Aug 4 02:52 netkit1.tgz 


247214 Aug 4 02:52 netkit2.tgz 

190648 Aug 4 02:53 netmap1.tgz 
82156 Aug 4 02:55 netmap2.tgz 

278498 Aug 4 02:55 netmon1.tgz 

159475 Aug 4 02:56 netmon2.tgz 
40356 Aug 4 02:56 netmon3.tgz 
78371 Aug 4 02:56 netmon4.tgz 
32554 Aug 4 04:42 ntfsdos.zip 
5120 Aug 4 05:02 nuke.exe 

1497924 Aug 4 05:04 ogre2.zip 
2270 Jul 19 08:05 passwd.cdb 
82394 Aug 4 03:29 


1325 Aug 4 03:20 pop.txt 
1080656 Aug 4 03:06 


280425 Aug 4 03:29 
23536 Aug 4 03:29 
387177 Aug 4 03:30 
36920 Aug 4 05:53 
768581 Aug 4 03:09 
6975 Aug 4 03:31 
287022 Aug 4 03:31 
276632 Aug 4 05:53 
212414 Aug 4 02:56 
44510 Aug 4 02:57 


10191 Aug 4 02:57 
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-rw-r--r-- 1 root root 190851 Aug 4 03:10 wwwhack.zip 


Not only are 90% of these tools used ONLY for malicious purpose, 
but you 

didn't even write them yourself, which qualifies you as a script 
kiddie. 

When the FBI busts you...you're welcome. 


[ — ]wrote: 


> 
> 
> Interesting that you would copy in people from wwfent.com. Is it 
safe 
> to assume that this is your client? 
> Why you think it is so important to conceal ANY information about 
this 
> | didn't understand until now..... 
> | was off-site when І received acalltha[ ^ Дай 
called 
> and informed my wife that my IP address was attacking one of his 
> sites. Thinking that my box may have been compromised, ! had it 
> powered down immediately. | have attempted to cooperate with you 


to 

> find out what happened and why. | have e-mailed you twice to 
find out 

> what was going on at your end (type of attack..etc.) but you 
don't 

> respond. 

> 

> Then finally you respond with the email below. 

> 

> From what you are saying, 

> "The webpage that you had on front had a forever 
looping 

> script, 

> which is why it appeared as if we were hammering 
your 

> site via http" 

> YOUR client initiated a connection to MY site!!!!!!! MY SITE 
NEVER 

> INITIATED OR ATTACKED ANYTHING!!! 

> 

> 

> "and the ftp logs were us logging in to your machine 
downloading 

> all 

> {һе hacker tools that were on your machine" 

> Зо now you have "hacker tools" on YOUR machine...should | 
contact 

> the FBI? BTW...the "hacker" tools you speak of were used to 
scan 

>  adomain (asdit.com (  Eiscom.net) at the domain 
owner's 

> request. 

> 

> Ultimately, there was NO attack!! THIS IS A PRIVATE 
UNPUBLISHED 

> address designed for my personal use and if you or anyone 
else 

> decides to connect to it that is your fault. That would 
explain 

>  whyltold you in my previous email that | could find no 
entries 


74 


> indicating that anything was initiated from my I.P. 
> 


> Unbelievable!!! Here | thought І had been compromised and my box 
was 

> being used for some kind of distributed DOS (the only thing ! 
could 

> think of since | knew that no one was intentionally attacking 

> anyone) and instead I find out it wasn't me at all. 


> 

> Since there are some new people in the conversation, | am 
attaching 

> the complete email history of the incident, starting with your 
initial 

> 

> 

> 

> 

> --- Original Messaqe----- 

> From: sitesmith.com] 

> Sent: Wednesday, August 09, 2000 1:35 PM 

>  Subjecc : 

> 

> Yes, the ip entries were all us, but that doesn't mean we 

> attacked you 

> machines. The webpage that you had on front had a forever 
looping 

> 

> script, which is why it appeared as if we were hammering 
your 

> site via 


> http and the ftp logs were us logging in to your machine 
> downloading all 
> the hacker tools that were on your machine. The client that 


this 

> has 

> happened to will most likely contact you or you will be 
contacted 

>  bythe 

> FBI. It is up to the client. | still cannot release the 
client 


> information to you, as it is under inverstigation currently. 
l 


> would . 

> seriously look at the config on your box, and go thru all 
the 

> logs and 

>  arvhive them... you are going to need it. 

> 

> Lote: 

> 

> > 

> > 

> > Did you recognize the IP/username/password from the log 

> entries | 

> > sent you yesterday? 

> 

> š 

> 
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From: 
> Sent gust 08, 2000 11:19 AM 
> To: sitesmith.com' 


E 

> Subject: ollow-up 

> 

тше 

> 

>  |was finally able to take a look at my server last night 
and 

> found some interesting entries in my http and ftp logs..... 

> 

> Itwould appear that you, or someone from within your 
company, 

> was repeatedly making http requests to my server from 

> approximately 1:30 am to 3:15pm EST on 8/4/00....about one 
every 

> minute or so. 

> 

> Тһе ftp log also has numerous connections from within your 

> organization during the same time frame. 

» There were zero entries for any outgoing requests.from my 
box to 

> anything affiliated with you. 

> 

> In other words, the logs are indicating that YOU were 
attacking 

> МҮ server. 

> 

> [have included a couple of the multiple entries from the 
ftp 

> log...perhaps you recognize the І.Р.в? (or the 
user/password?) 

> 

> Obviously, | am dealing with a mature professional here... 

2 

> [ C ]8mydomaing.com, 8/4/00, 9:56:16, 

>  MSFTPSVC, COMANDUR’, -, 0, 30, 0, 0, 0, [78] PASS, 

> my.domaing.com, -, 

> 

> zeus.corp.sitesmith.com, 8/4/00, 
12:52:0 

> MSFTPSVC, COMANDUR1, -, 883701, 0, 0, 0, 64, [79] closed , 
, x 

> isco nel, 

> 8/4/00, 3:50:30, MSFTPSVC, COMANDURY, -, 29643, 44, 287022, 
0, 0, 

> [61] 

> 

> 

> 


f  _ |@mvdcorg, 8/4/00, 3:43:59, 
x 


COMANDUR1, -, 0, 27, 0, 0, 0, [62] PASS, 
mydic.org, 


= 
у 9 


Let те reiterate from my first email to уои, 
You have made some very serious accusations against me. | 


for a fact that you have contacted others with these 
accusations. You have shown absolutely no professionalism, 


A 
222) 
vvgvvvv 


o 
E 


> intelligence for that matter. | expect you to either 
provide 
> adequate proof that | or any of my equipment was involved in 
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incident or issue a formal apology. 


> My name i апа | am the owner of 
> comandur.com iscom.net. 
T ^ |оплагава this conversation between you and him to 


me... 

> 

> For clarification: 1 received a message from ы 
Friday 

> August 5th around 3:15pm that my IP address was "attacking" a 
site 

> maintained by sitesmith.com. Since | was away from the site at 
the 

> time and unable to verify this information, | had someone 
disconnect 

> the server at approximately 3:20pm and attempted to return 


> call, however he was not at his phone. Since then, | have left 
the 

> server down so that | can determine if it has been compromised. 

> 

> Jump to today: С фама this email to me and as | 
read 

> through it | am completely confused as to what you are trying to 
Say. 
> You state tha[ | email is plastered all over the "hacked" web 


> sites page. You say that the site has been hacked...you say that 


> tomr.siscom.net is hacked and that the compromised box attacked 
your 
> client when you emailed| Jou say th — biscom.net has 
hacked 

> comandur.com...you say that comandur.com is the hacker and they 
hacked 


T _ Бізсотлес.... 


> 

> All of these statements are either utterly ridiculous or 
completely 

> wrong. (or both) 

> 

> | know for a fact that no one was knowingly or intentionally 

> "attacking" ANY sites from 
> comandur.co iscom.net/209.251.13.206. 
: P 

> | am more than willing to assist you if | can, however, | need 
more 

> information than what you have provided so far. What was the 
nature 

> of the attack? What sites were being attacked? How long did the 
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> attack last? etc... 
> 


> You are making some very serious accusations and have provided no 


> proof to substantiate them. 
> 

T —] 

> 

> 


> ----- Original Меѕѕаде----- 


> Егот: 

> бепї: Monday, August 07, 2000 2:58 РМ 
> То: | ] 

> Subject: FW: Is this a real email address?? 
> 

> 

элеге OriainaLMessade;---- 

> From; 

> Sent: Monday, August 07, 2000 12:27 PM 
> To: 

> Subject: RE: Is this a real email address?? 
> 


> idle threats now... I like. Please refrain from emailing me 
again 
> unless 1), its from your attorney. -or- 2), your willing to 
provide 
> details, such as "Who got hacked" "When?" "From who?" "| got your 


» email address from a hacked site" (which obviously you didnt, as 
you 

> already said you got it from www.1115.net) "Why you think they 
were 

> hacked" "Some sort of proof" "Proof you have a clue" (most 
important.) 

> "And anything you can think of" 

> 

> Thank You 


> P.S. If your that worried about your security that you wont 
provide 

> any of these details, follow these instructions: 

> 1. Unplug the computer from the network. 

> 2. Shoot yourself in the head. 


> Subject: Re: Is this a real email address?? 

[шш Г; is hacked and the person that compromised this 
_ > attacked my client when I emailed you. 1 am going to need records 
= > who 

> that domain belongs to and if you are not willing to cooperate, 
ne: EBI 


> may be involved. 
> 


> 
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>> 
> > 


> | ^ Бесотле! was NOT hacked by comandur.com. 


[  ]siscom.net IS 


> > comandur.com. 
>> 


> > Thank you. :) 
>> 


> > Subject: Re: Is this a real email address?? 

>> 

> > The site that was hacked waq__|siscom.net, the reason I link 
you 


>> 

> > it is because you ad ^ f hacker, which means 
you 

> must 

> > have his info. 


>> 


>> 
>>> 
>>> 


> > > You can link me to beng because i am.. 
>>> 


> > > How you can link me to the compromised site, i have no clue. 


> dont 


> > > know which site is being hacked or was hacked. 
>>> 


> >'> Subject: Re: Is this a real email address?? 

>>> 

> > > Well, it would be nice to know why | was able to link your 
name to 

> 

> > > both 

> > > the compromised site (which 1 can confirm is 
compromised....ftp in 

> 


>> as 
[ шы and tell me what you see) and you beng | 


de Дио 


>>> 
>> >> 
>> >> 
> > > > Oh.. i see, If there is anything you need from me, let me 
know. 


> > > > From @sitesmith.com] 


Is à real email address?? 


> > > > uh, yeah except the motherfucker is hacking my site. 
> > > > 


>>> wrote: 
>>>> 


>>>>> 

>>>>> 

> > > > > correct.. | just [ — omandur.com, whatever 
content is 

>on 

>> 

>>> the 

> >>> 


> > > > > page is his own fault.. 

>>>>> 

> > > > > afaik siscom.net == comandur.com.. so nothing 
unusual is 

> 

`> > > going 

> >>> 

> > > > > on here. 

>>> >> 


> > > > > From @sitesmith.com] 


> > > > > Sent 

> > > > > To: 

> > > > > Subject: 

>> >>> 

> > > > > Sorry to leave you in the dark. comandur.com IS the 
hacker, 

> and 

>> 


> > > you 
> >>> 


>>>> [i  ]him. So | may need some help from you. 
The 
> > victim 
> > > jis 


>>>> 
> > > > > siscom.net ..... check | мотла 
>>>>> 


>>>>> 

>>>>>> 

>>>>>> 

> > > > > > Okay, everything was going good for ту day, then you 
mention 

> 

> > > > this.. 

>>> >>> 

> > > > > > ... then withhold details, like "One of the 350 
websites you 

> 

> > > host 

> > > > > was 

> > > > > > hacked" 

>>> >>> 

> > > > > > eluding to 1115.net as the site that was hacked.. but 
yeti 

> > сап 

> > > > find 

>>> >> 

> > > > > > no signs anywhere... 

>>> >>> 


> > > > > > |f you would be so kind, please email me a link to a 


@ 
ee 56. 


is a real email address?? 
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hacked 
> > > page, 
>> >> so 
>> >>> 


> > > > > > some other proof.. This is driving me crazy. 
>>> >>> 


>>>>>>1 

>>>>> 

>>>>> 

> > > > > > Navistar International 
>>>>>> 

> > > > > > ----- Oriai === 


> > > > > > From: sitesmith.com] 


> > > > > > бег Eri 4, 2000 12:45 PM 
> > > > > > To: 
> > > > > > Subject: Re: Ts this a real email address?? 


>>> >>> 


> > > > > > А site you provide DNS for was hacked.... 
>>> >>> 


>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > which site was hacked? апа what makes you think it 


was 


> > hacked? 
>>> 


>>>>>>> 

> > > > > > > ----- Original Меѕѕаае----- 

From]‏ <<< < < < ج 

Гессе 
>>>>>> Eri 04, 2000 12:18 PM 

> > > > > > > Subject: Re: Is this a real email address?? 

>> >>>>> 

> > > > > > > Apparently you didn't understand my response. Your 
email 

>is 

> > > > > > plastered 

> > > > > > > all over a website that was hacked, and more 
importantly, 

> > you 

>>> 

>> qm 

>> >> 

>> >>> 

>>>>>> 


> > > > > > > this hacked website. 
>>> > >>> 


>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > what makes you think that? 
>>>>>>>> 

> > > > > > > > ----- Ора 

> > > > > > > > From 


> > > > > > > > Subject: Re: Ts This a real email address?? 


>>>>>>>> 
> > > > > > > > Actually, | would like to be even more 
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specific...... | b6 
> > got ' bic 
> > > > your 
>> >>> 


> > > > > > > email 
>>>>>>>> 


> > > > > > > > address from а hacked website. 
>>>>>>>> 

»»»»»»»p Мое: 

>>> >>>>> 

>>> >>>>>> 

>>>>>>>>> 

> > > > > > > > > Yes | do... get my email address from whois 
> > information? 

>>>>>>>>> 

> > > > > > > > > ----- Original Message----- 
2.4.2. 
ی‎ 


sitesmith.com] 


> > > > > > > > > Sent: Friday, August 04, 2000 10:59 AM 
E OE лг 7 323 C 
> > > > > > > > > Subject: Re: Is this a real email address?? 


>>>>>>>>> 
> > > > > > > > > Let me ask you something... .do you have any 
> > affiliation 

> > > > with 

>>>>> 

> > > > > > > > > 1115.net? 

>>>>>>>>> 

>>>>>>>>>| uote: 

>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>>> 

> > > > > > > > > > This HAS to be the weirdest email | һауе had іп 


> > while. 

>>> 

>>>>>>>>>> 

> > > > > > > > > > ----- Original Меѕѕаае----- 
>> > > > > > > > > 


>> sitesmith.com] 
>> t: Friday, August 04, 2000 2:10 AM 
> > > > > > > > > > To: @navistar.com 


> > > > > > > > > > Subject: TS ms а real email address?? 

>>>>>>>>>> 

>>>>>>>>>> If this is а real address please 
respond... 

>>>>>>>>>> 

>>>>>>>>>>-- 

>>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > > WWW-SITOSITIIT1.COm 

> > > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>>> 


>>>>>>>>> 

>>>>>>>>>-- 

>>>>>>>>> 

>>>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmith.com 

> > > > > > > > > "We are the master Internet Craftsmen" 
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> > > > > > > > > Customer Care Center (888) 898 7667 b6 
>>>>>>>>> b7C 
>>>>>>>> 

>>>>>>>>-. 

>>>>>>>> 

>>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > > www.sitesmith.com 

> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
> > > > > > > >. 


>>>>>>> 

> > > > > > > -- 

>>>>>>> 

>>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 

> > > > > > -- 

>>>>>> 

>>>>>> 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We аге the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 

>>>>>-- 

>>>>> 

>>>>> 

>>>> 

>>>> 

> > > > > WWW.Ssitesmitn.com 

> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 


>> >> 
>> > > -- 

>> >> 

>>> 

>>> 

>>> 

> > > > www.sitesmith.com 

> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>> >> 


>>> 
> > > -- 
">>> 
>> 
>> 
>> 
> > > WWW.sitesmith.com 
> > > "We аге the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
>>-- 
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WWW.Sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


now writing to VP of our company 
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From: Ld sitesmith.comy 


Sent: pde 1:55 PM b6 
To: b7C 
Subject: quick report | drew up for upper management 


WWF Incident Report 


It has come to my attention that there is an immediate need to 
clarify the chain of events that have led us to where we are in this 
situation right now. I think all of the parties that are involved have 
got some of their facts mixed up. For the record, I would just like to 
clarify that I do not personally know — ^ 1] nox 
do they know me. 

It is a well known fact that WWF has machines that are compromised. We 
have been investigating this incident , and there was no security on 
WWF's site since day one. With that said, I would just like to point out 
that most logs can be edited with a simple text editor, unless you are 
viewing them in realtime. On Thursday night, at approximately 11:30pm, 


iencing problems with their site 2222252 2.4 

F ee myself worked proactively on the site. After applying 
some simple Access Control Lists to the Arrowpoint E to 
notice some strange logs occurring due to packets not matching any rules 
on the ACL clause he had just applied. He called both and myself 
over to come and look at the log files. What we noticed was quite 
strange. It appeared as if someone was trying to leverage a Netbios port 
(137) to either gain access or browse certain machine information. 
Immediately after seeing this, we thought we had better do some 
investigation, since we already knew that machines on the WWF site had 
been compromised. Our first thought was to find out where this machine 
was located. Various traceroutes showed that the machine was in the 
siscom dot net domain, and that it's hostname was "tomr.siscom.net” and 
it’s IP address was ا‎ reversing this IP address a 
second look showed that it also had another domain associated with it, 
"comandur.com". We then began to take a look at the machine. When the IP 
address was put into a browser, a very simple web page came up. On this 
page was the time (it was about 45 minutes off) and a pair of eyes that 
followed your mouse around the screen. On the left hand side of the page 
was a "close" button. When one moved their mouse and clicked the close 
button, it wou p up a your default mail client with a message to 
com. So I filled out the email and sent it off. While 
I did this, іемеа the page source, and saw that it had some 
interesting Iinks to a site that didn't exhist. After the page finished 
loading, it tried to redirect you to WW.What.The.Fuck.Is.This and it 
stopped loading. So I closed my browser window and scanned the machine 
in question. Upon completion of the scan, it revealed that the machine 
had a wealth of ports open, one of which was ftp. I showed my findings 
to and we then logged into the ftp machine as anonymous, using 
fake email addresses as our passwords. Upon login, I found a multitude 
of hacker tools, which I promptly began to download, simply because I 
wanted to know what all the hacker tools were, since some of them may 
have been deployed against our client. Once again, 

we visited the page, and noticed that the page was updated because the 
time had 

moved forward. This indicated that someone was also proactively working 
on the 

web page. We were still seeing the queries to port 137 of our clients 
Virtual IP, so 

we decided that we should contact Siscom, except they only have regular 
business 

hours ext step was to get in touch with the backbone provider, 
which 

handled quite smoothly. He explained the situation to them and asked 
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> 
> 


> 
> 
> 
> 
> > WWW.sltesmith.com 


> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 
>-- 
> 


ا ا ee‏ 


> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


> 


هه 


s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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"We аге the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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them to do 

something about it, and they claimed they were going to put ап ACL on 
their 

gateway to level3, which they didn't do. The staff at UUnet told us 
that we should 

also contact level3 and have them do the same. We explained that level3 
wouldn't 

do that, and asked them to look at the webpage we were viewing. At this 
time, we 

were once again contacted by the ICCC, to let us know that another 
machine was 

showing critical. We explained to the ICCC about the situation, and 
also asked 

them to view the webpage. They thought it was amusing. When I viewed 
the page 

myself once again, I noticed that not only was the time dead on track, 
but it was 

now updating in realtime. I viewed the page source, and noticed that 
code had 

changed. Now the time was updating on it's own, and a forever looping 
script was 

placed on the main page. So, someone was definitely working on this 
machine at t 

this exact moment. After some time of poking around, we discovered who 
was 


Ere comandur.com, and thought maybe we should contact 
them. 


Not sure whether any of the information we saw in the DNS records was 
correct, I 

Sent an email ce[ E] carefully wording what I said. The 
only thing I 

Said in the preliminary email was, "If this is a real address please 
respond...". 

Again, like I said, we know how hackers work, and they usually aren't 
alone in 

The things they do. The email address I sent this message to was 

navistar.com which happens to be a truck manufacturing 

company. 

The time was now 2:09am and we were tired. We decided that we must call 
level3 

And explain the situation. | once again handled this quite 
gracefully and got 

Them to comply by blocking this address from entering the site. Within 
minutes, 

The same attack on port 137 began again, this time, from randomly 
spoofed 

Addresses. This indicated to us that someone immediately knew we were 
on to 

Them. We continued to proactively monitor the site through the night, 
fearing that 

If we left the office, the site would go down. 

Moving forward, many events have occurred that lead us to certain 

conclusions. I will provide all the emails necessary to show EXACTLY 
what was 

Said between all parties. The following is a list of facts. 


Upon initially hearing from I asked him to provide me with 
contact information for the individual who owns comandur.com because the 
information ined in the ARIN database was all ficticious. 

and work for Navis 
who or conandur-com] | 1115.net and the 
the site is fake. 
laims to bea[ ^ ^ ^ ]yet failed to grasp the 
concept of the simple forever looping script on the front of his 
webpage. | 

1115.пе& is obviously а fake site since many links on the site аге 


broken. 
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There are fake links all over 1115.net 


Now it is true that I lied SEEN Бы. that his email was 
plastered all over comandur.com and the reasoning for this was simple. 
These people are using social engineering skills, and obviously are 


somehow related. Upon me asking for contact information for the owner of 
comandur.com, instead of complying, ^ |вілріу forwarded my email 


to of the domain. i e did this because he 
didn't want to be caught in the middle. Г ue fabricated events 
that obviously didn' appen. He emailed me saying that he tried to 

2-2. when he couldn't get in touch with[ ае 


called someone to unplug the box. It was quite obvious from the start 


that was ered. My first clue was that he said he 
tried to contac on Friday August 5th, when Friday was 
the 4th, although sounded quite professional in the rest of 


his letter. After he contacted me again, he then tried to turn the 
tables and say it appeared as if we were attacking his machine, because 
he saw so many entries for us hitting his webpage and his ftp server. 
The reason for so many entries in his http logs would be the forever 
looping script, and the reason for the ftp entries, was me downloading 
the tools I found on his server. Then[ ^ ^ ^ |кезропбв to me telling 
him about all the hacker tools I found on his computer, and he said, 
"They are domain scanning tools". Well, I have heard it all, because 
there were not only domain scanning tools, but there were viruses, 
Backorifi ojans, as well as hacking kits of all types. When 
I emailed to show him the list of tools I collected from his 
machine, he then began to tell me that "some of his colleagues" must 
have uploaded the tools on his machine, yet in the previous email he 
said he checked over his computer and everything appeared normal. 
Interestingly enough, one of the tools I found | 22 7 a 
would most likely give the same type of attack fingerprint that we were 
seeing on 8/3-8/4. Following that, Lo Î then began to tell me he 
was a security consultant, which would indicate that he has the 
knowledge to use the tools for malicious purposes. When he realized that 
WWF was the site that was hacked, he then said that “his Wife and 

ited the site that night". I would be willing to bet that 

computer is located in a datacenter, and that his Wife and 
Daughter don't have access. I would also be willing to bet that neither 
his Wife nor his Daughter tried typing http://www.wwf.com:137/ to 
access the site. What most likely happened was his computer was 
compromised and he doesn't want to tell us. If he is so sure that his 
computer wasn't compromised, then why hasn't it been brought back online 
yet? This is an ongoing i ething needs to be done. I am no 
longer communicating mec ET because there is no need for 


me to. I have other issues to deal with pertaining to WWF. If there are 


] or concerns, please feel free to call me оп my Cellphone 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From e tesmih.com] 
Sent: Friday, August 04, 2000 11:19 AM 
T aes 


Subject: Re: Is this a real email address?? 


Actually, | would like to be even more specific...... 1 got your email 
address from a hacked website. 


> 
> 


> Yes | do... get my email address from whois information? 


> Subject: Re: Is this a real email address?? 

> 

> Let me ask you something... .do you have any affiliation with 
> 1115.net? 


[rote 


> 

>> 

>> 

> > This HAS to be the weirdest email | have had in a while. 


areal email address?? 


>> If this is a real address please respond... 


> > www.sitesmith.com 
> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 
> 


> mum m 


> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 


S 


© ل“ 
NQ‏ 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen” 
Customer Care Center (888) 898 7667 


D ا‎ 


From: sitesmith.com] pë 
Sent: :59 PM BIC 
To: 

Subject: Me trying to correct my previous mistake 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
D 


Fri, 04 Aug 2000 11:19:13 -0400 


Fr 
X- 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 


MIME-Version: 
1.0 
To: 


| аттатат 
ubject: 


Re: Is this a real email address?? 
References: 


L weye И 
-Type: 


text/plain; charset-us-ascii 
Content-Transfer-Encoding: 
Tbit 


Actually, | would like to be even more specific...... | got your email 
address from a hacked website. 


NENNEN — 


> 
> 


> Yes | do... get my email address from whois information? 


@sitesmith.com] 


> Subject: Re: Is this a real email address?? 
> 


> Let me ask you something.... .do you have any affiliation with 
> 1115.net? 
> 


| 
| >> 
| 


>> 


> > This HAS to be the weirdest email | have had in a while. 


> > Www.sitesmith.com 
> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 
> 


> quu 


> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: = 
Sent: urs а Е | 59 PM 


Subject: Me telling him where I got it... by accident Da 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Mess - 
@sitesmith.com> 


Fri, 04 Aug 2000 11:17:31 -0400 
From: 


X-Mailer: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 


r | 


ubject: 
Re: Is this a real email address?? 
References: 


sprxspn3.spr.navistar.com> 
Content-Type: 
text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 


NO, actually | didn't. | got it from 1115.net's site. 


[ — fwote: 


> 
> Yes | do... get my email address from whois information? 


> Subject: Re: is a real email address?? 


7 Let me ask you something.... .do you have any affiliation with 
> 1115.net? 
> 


>> 
>> 


> > This HAS to be the weirdest email | have had in a while. 
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> > ----- Original Меѕѕаае----- 
> > From: sitesmith.com] 


> > Sent: Friday, August 04, 2000 2:10 AM 
>> OMNEM E. 
> > Su T is a real email address?? 


>> If this is a real address please respond... 


> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

> we 

> 

> 


> www.sitesmith.com 
> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


s. s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


sitesmith.com] B 7C 


From: 


Sent: Thursday, August 17, 2000 12:58 PM 
To: 

Subject: im asking where | got his email from 
X-Sieve: 


cmu-sieve 1.3 


Return- : 
nav-international.com> 
Received: 


[ .[ havistar.com (mail.navistar.com 
ا ا‎ dr 
with ESMTP id for 
sitesmith.com>; Fri, 4 Aug 2000 07:59:44 -0700 
DT) 


Received: 
from 


y navistar.com (PMDF 


with ESMTP id 
navistar.com> for 
sitesmith.com; Fri, 4 Aug 2000 10:01:20 CST 
Received: 
b navistar.com with Internet Mail Service 
Fri, 04 Aug 

2000 10:01:19 -0500 
Content-return: 

allowed 

Date: 
Fri, 04 Aug 2000 10:01:16 -0500 


nav-international.com> 


s ы 
RE: Is this а real email address?? 


Mess 7 


1.0 


X-Mailer: 
Internet Mail Seve 1] 
Content-type: 
multipart/alternative; 
boundary-"---- = NextPart 001 O1BFFE24.D6CA8EAO0" 
X-Mozilla-Status: 
8013 
X-Mozilla-Status2: 
00000000 


“To 


Yes I do... get my email address from whois information? 


от] _ _  _ lestesmihcom] 


Sent: Friday, August 04, 2000 10:59 AM b6 
Subject: Re: Is fhis a real email address?? 


Let me ask you something.... .do you have any affiliation with 1115.net? 


| > 
| > 
> This HAS to be the weirdest email 1 have had in а while. 


> From sitesmith.com] 


> Sent: Friday, August 04, 2000 2:10 AM 
> UMEN уту 
> Subject: Ts this a real email address?? 


> 
> If this is a real address please respond... 


Бикен 


> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


MEME 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: NENNEN LL 
Sent: ursday, August 1/, 2 :57 PM 


To: 
Subject: My reply t first response 


-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
sitesmith.com> 
D 


Fri, 04 Aug 2000 10:59:18 -0400 
Г —— 1 

X-Mailer: 

Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 
To: 


| — 


Subject: 
Re: Is this a real email address?? 
References: 


sprxspn3.spr.navistar.com» 
text/plain; charset=us-ascii 


Content-Transfer-Encoding: 
Tbit 


Let me ask you something... .do you have any affiliation with 1115.net? 


> 
> 


> This HAS to be the weirdest email | have had in a while. 


» From: sitesmith.com] 


> www.sitesmith.com 
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> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


mE i 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


106 


[з ЕСЕ 


From: NENNEN LL 
Sent: ursday, August 17, 20 2:56 PM 

To: 

Subject: irst response 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 
@nav-international.com> 


Received. 


— | [ ]navistar.com (mail.navistar.com 
by Wipe О ш. 


with ESMTP id _ for 
sitesmith.com>; Fri, 4 Aug 2000 07:24:56 -0700 


T) 
Received: 


navistar.com> for 
itesmith.com; Fri, 4 Aug 2000 09:26:25 CST 
Rec : 
b .navistar.com with Internet Mail Service 
i ri, 04 

Aug 2000 09:26:11 -0500 
Content-return: 

allowed 

Date: 
Fri, 04 Aug 2000 09:26:08 -0500 


Fro 
[pina international com> 
Subject: 


RE: Is this a real email address?? 


itesmith.com> 
Message-ID: 


X-Mailer: 
Internet Mail Service|) | 


Content-type: 

multipart/alternative; 

boundary="---- = NextPart 001 O1BFFE1F.EEA4C1CBO" 
X-Mozilla-Status: 

8013 
X-Mozilla-Status2: 

00000000 

X-UIDL: 


This HAS to be the weirdest email | have had in a while. 
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Sent: Friday, August 04, 2000 2:10 AM 
To: mama 
Subject: TS this a real email address?? 


If this is a real address please respond... 


m = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


2 ж — 


From: С þstesmitn.com] 


Sent: Thursday, August 17, 2000 12:55 PM 
To: | | 
Subject: ocumenting of the uunet ticket we opened 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 
sitesmith.com» 
Received: 
from mailbox.sca1.sitesmith.com (localhost 


by mailbox.sitesmith.com (Postfix) with 
ESMTP id Thu, 3 Aug 2000 23:29:27 -0700 
(PDT) 


Deliv -Io: 
itesmith.com 
Received: 


from zeus (unknown [63.144.153.254]) by 


mailbox.sitesmith.com (Postfix) with ESMTP id 
fo sitesmith.com>; Thu, 3 Aug 
2000 23:29:25 -0700 (PDT) 


Date: 
Fri, 4 Aug 2000 02:28:51 -0400 (EDT) 
From: 


sitesmith.com> 
X-S 
zeus.corp.sitesmith.com 
0: 


in-wwfLis( ^ ^ psitesmith.com» 


Message-ID: 


zeus.corp.sitesmith.com> 
MIME-Version: 
1.0 
Content-Type: 
TEXT/PLAIN; charset=US-ASCII 
Subject: 
{int-wwf] uunet 
Sender: 
sitesmith.com 
Erro а 
sitesmith.com 
X-Mailman- ТОП: 
1.1 
Precedence: 
bulk 


Listga 
.mailbox.sca1.sitesmith.com> 
X-Been There: 


mailbox.sca1.sitesmith.com 
X-Mozilla-Status: 
8001 
X-Mozilla-Status2: 
00000000 


Hash: SHA1 


ticket # B-TSI-000541150 

put acl's on gateway peering router for oc-12 ... 
because he didn't see the traffic, he took it off ... 
believes that attack is not coming from uunet backbone 


Version: PGPfreeware 5.0i for non-commercial use 
Charset: noconv 


iQA/AWUBOYpigLvNQYiUgEg9EQJxcACghIQUKEfbS6tFICviuZA+BoeVOMgAoOi3 
btffEBQV6QatSIVVKS/jtyOP 
-hq6C 


mum s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


-—————————! 


From: [  — _ bstesmith.coml 

Sent: Thursday, August 17, 2000 12:53 PM 

To: 

Subject: My first email d | e 
b7 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
[ — — — — Jositesmith.com» 


Date: 
Fri, 04 Aug 2000 02:09:59 -0400 


From: 
sitesmith.com> 


X- | 
Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 


en 
MIME-Version: 
1.0 
T . 
navistar.com 
Su : 
Is this a real email address?? 
Content-Type: 


text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
7bit 


If this is a real address please respond... 


mm Б 


"We аге the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


mm s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


| Sent: ursday Augus :20 PM ETE 


Subject: Some useful "internal chatter" 


I have no idea who the IP address at the bottom belongs to, and | don't 
think we ever found out who it belonged to, so you may want to look into 
phone records, etc to find out who this person is and why they were 
logged into our box. 


X-Sieve: 
cmu-sieve 1.3 
Return-Path: 
@sitesmith.com> 
Received: 
from mailbox.sca1.sitesmith.com (localhost 


[  _ ]bymailbox.sitesmi 
with ESMTP id Sat, 5 Aug 2000 


10:29:39 -0700 (PDT) 


Deliv -To: 
sitesmith.com 
Rec 


| from mailbox.sca1.sitesmith.com (localhost 


[  _ утайһох.вйевтті i 
| with ESMTP Шы 5 Aug 2000 
x 10:29:36 -0700 (PDT) 
| Delivered-To: 


sitesmith.com 
Received: 


| from Junkow[ ° by 


mailbox.sitesmith 1 ith SMTP 
id at, 5 Aug 2000 10:29:33 -0700 


| (PDT) 


@sitesmith.com> 


Sat, 5 Aug 2000 13:35:21 -0400 
Message-ID: 


1.0 
Content-Type: 
text/plain; charset="iso-8859-1" 
Content-Transfer-Encoding: 

Tbit 

X-Priority: 
3 (Normal) 

X-MSMail-Priority: 

Normal 

X-Mailer: 
Microsoft Outlook IMO, Build 9.0.2416 


== 


Produced By Microsoft MimeOLE V5.00.2314.1300 


21 


b7C 


Importance: 
Normal 


Subject: 
[ano just logged into each WS machine 
and rebooted them?! 


X-Mailman-Version: 
1.1 
Precedence: 


ailbox.sca1.sitesmith.com> 


mailbox.sca1.sitesmith.com 


Se 
sitesmith.com 
Erro 
itesmith.com 
X-Mailman- 
1.1 
Precedence: 
bulk 


8003 
X-Mozilla-Status2: 
00000000 
X-UIDL: 


1 was logged into each machine while this person reset them. And they 
were 

running FINE. Squid was running and handling requests. 1 reset WS1 
myself at 

around 12:30 because it was hung, but everything else was fine, and WS1 
came 

up fine in a few minutes. 


This is the kind of thing that makes a site unstable, who authorized 
this? 


if everyone agrees] sd and ^ Bsitesmith.com should be 


notified at ANYTIME a system a rebooted by a human being. It should be 
stated WHY the machine is being reset, and any relevant details 
included. 


We should also make different usernames for each 'vendor' who will be 
logging into the systems. 'remwwf is to generic, we need some 


accounting of 
WHO is making changes and WHO has access. 


I tried to talk to the person resetting the systems, but was ignored. 


roadcast message from root (pts/1) Sat Aug 5 13:21:13 2000... 


The system is going down for reboot NOW !! 


wwf2 remwwf}# netstat -an |grep EST |grep ":22" 
cp О  064.152.0.182:22 63.144.153.254:30476 
ESTABLISHED 
tcp 0 1752 64.152.0.12:22 209.255.50.26:1046 
BLISHED 
wwi2 remwwf]# nslookup 209.255.50.26 


Server: u.net 
Address: 

Name: 

Addres 


ГР"? remwwf]# 


ailing list 
mailbox.sca1.sitesmith.com 


http://mailbox.sca1 sitesmith.com/mailmanilistinff | 


ailing list 
mailbox.sca1.sitesmith.com 
" птайрох.ѕса1.ѕќеѕтіћ.сот/тайтап/іѕі | 


mM s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


Subject: ut & paste of the logfile 


X-Sieve: 
cmu-sieve 1.3 


Return- 8 
sitesmith.com> 
Received: 


from mailbox.sca1.sitesmith.com (localhost 
Г mailbox wawa er ) with 


ESMTP id Thu, 3 Aug 2000 22:46:12 -0700 
(PDT) 
Delivered-To: 
[^ Jestesmi.com 
Received: 


from zeus (unknown by 


mailbox.sitesmith.com (Postfix) with ESMTP id 
Thu, 3 Aug 2000 22:46:10 -0700 (PDT) 
Date: 


Fri, 4 Aug 2000 01:45:42 -0400 (EDT) 
From: 


рњо» 
Х-5 H 


zeus.corp.sitesmith.com 
uunet.net 


uunet.com, int-wwf List 
sitesmith.com» 
Message-ID: 


l1 D@zeuscorp.sitesmitn.com> 
-Version: 


1.0 
Content-Type: 
TEXT/PLAIN; charsetzUS-ASCII 


E 
Se Н 
sitesmith.com 


Ег = 
sitesmith.com 
X-Mail - 


1.1 
Precedence: 
bulk 
List-Id: 
mailbox.sca1.sitesmith.com» 
X-Been 
mailbox.sca1.sitesmith.com 
X-Mozilla-Status: 
8001 


X-Mozilla-Status2: 
00000000 


E s 
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4 00:23:19 6/1 16751 ACL-7: NO ACL rule match! Discarding packet 
4 00:23:19 6/1 16752 ACL-7: UDP  SrcPort: 137 DestPort: 137 

4 00:23:19 6/1 16753 ACL-7 

4 00:23:19 6/1 16754 ACL-7 

4 00:23:19 6/1 16755 ACL-7: 


4 00:23:19 6/1 16756 ACL-7: NO ACL rule match! Discarding packet 
4 00:23:19 6/1 16757 ACL-7: UDP SrcPort: 137 DestPort: 137 


4 00:23:20 6/1 16758 ACL- 

4 00:23:20 6/1 16759 ACL- 

4 00:23:20 6/1 16760 ACL-T- 

4 00:23:20 6/1 16761 ACL-7: NO ACL rule match! Discarding packet 
4 00:23:20 6/1 16762 ACL-7: UDP  SrcPort: 137 DestPort: 137 

4 00:23:20 6/1 16763 ACL- 


4 00:23:20 6/1 16764 ACL- 
4 00:23:20 6/1 16765 ACL-7: 


4 00:23:20 6/1 16766 ACL-7: NO ACL rule match! Discarding packet 
4 00:23:20 6/1 16767 ACL-7: UDP SrcPort: 137 DestPort: 137 


4 00:23:20 6/1 16768 ACL-7 
4 00:23:20 6/1 16769 ACL-7 
4 00:23:20 6/1 16770 ACL-7: 
4 00:23:20 6/1 16771 ACL-7: NO ACL rule match! Discarding packet 


4 00:23:20 6/1 16772 ACL-7: : 137 
4 00:23:20 6/1 16773 ACL-7: 
4 00:23:20 6/1 16774 ACL-7: 
4 00:23:20 6/1 16775 ACL-7: 


4 00:23:20 6/1 16776 ACL-7: NO ACL rule match! Discarding packet 
4 00:23:20 6/1 16777 ACL-7: UDP SrcPort: 137 DestPort: 137 


4 00:23:20 6/1 16778 ACL- 
4 00:23:20 6/1 16779 ACL- 
4 00:23:20 6/1 16780 ACL-7t 


sitesmith.com 


mailing list 
mailbox.sca1.sitesmith.com 


http://mailbox.sca1 sitesmith.com/mailmantistinf{ | 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
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Customer Care Center (888) 898 7667 
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From: 
Sent: 
To: 
Subject: 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
@sitesmith.com> 
Date: 


Fri, 04 Aug 2000 01:11:48 -0400 


Fr 
Х- 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 


en 
MIME-Version: 


1.0 
comandur.com 
S - 
WAZZZZUUUUUUPPPPPHIHt7mm 
Content-Type: 


text/plain; charset-us-ascii 
Content-Transfer-Encoding: 
ТЫҢ 


Who's ur daddy :о> 


mu s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


m = 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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EE 


From: sitesmith.com] 
Sent: 731 PM b6 
To: b7C 
Subject: My reply to that one liner from| | 
X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
D 


Mon, 07 Aug 2000 11:42:24 -0400 
From: 


xX- 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 


en 
MIME-Version: 
1.0 


| — 


Subject: 
Re: Is this a real email address?? 
References: 


Po Bsprxspna.sprnavistarcom> 


Content-Type: 
text/plain; charsetzus-ascii 
Content-Transfer-Encoding: 
Tbit 


L ]siscom.com is hacked and the person that compromised this box 
attacked my client when | emailed you. | am going to need records of who 


that domain belongs to and if you are not willing to cooperate, the FBI 
may be involved. 


> 

> 

>— Eiscom.net was NOT hacked by comandurcom| ^^ biscom.net IS 
> comandur.com. 

> 

> Thank you. :) 

> 


> Subject: Re: Is this a real email address?? 


» The site that was hacked wa ^^ iscom.net, the reason 1 link you to 


2 


> 


> itis because you ad ^  ]o a hacker, which means you must 
7 have his info. 
> 


>> 
>> 


> > You can link me to being ë because i am.. 
>> 


> > How you can link me to the compromised site, i have no clue. | dont 


> > know which site is being hacked or was hacked. 
>> 


>> To: 

> > Subject: Re: Is this a real email address?? 

>> 

> > Well, it would be nice to know why I was able to link your name to 
> > both 

> > the compromised site (which ! can confirm is compromised....ftp in 
> as 


> > anonymous and tell me what you see) and you being a[ 1] 
> 


> rote: 
>> 

>>> 

>>> 


> > > Oh.. i see, If there is anything you need from me, let me know. 
>>> 


>>>---- Orjai 
> > > Sent: Friday, Au ; B 


>>> То 
> > > Subject: Re: Is this a real email address?? 
>>> 


> > > uh, yeah except {һе motherfucker is hacking my site. 
>>> 


>>> 
>>>> 
>>>> 


> > > > correct.. | jus ^ pomandur.com, whatever content is on 


> 


> > the 
>>> 


> > > > page is his own fault.. 
>> >> 


> > > > afaik siscom.net == comandur.com.. so nothing unusual is 


> > > > on here. 
>> >> 


> > > > From 


> > > > Sent: Friday, August 04, I 
>> >> To 
> > > > Subject: Re: Is this a real email address?? 


>>>> 
> > > > Sorry to leave you in the dark. comandur.com 1S the hacker, and 


3 


> 


> > you 
>>> 


>>> { |] him. So | may need some help from you. The 
> victi 


> >is 
>>> 


> > > > siscom.net ..... check out tomr.siscom.net 
>> >> 


>> >> 

>> >>> 

>> >>> 

> > > > > Okay, everything was going good for my day, then you mention 
> > > this.. 

>> >>> 

> > > > > ... then withhold details, like "One of the 350 websites you 
> > host 

> > > > was 

> > > > > hacked" 

>> >>> 

> > > > > eluding to 1115.net as the site that was hacked.. but yet i 
> can 

> > > find 

>>>> 

> > > > > no signs anywhere... 

P> >>> 

> > > > > If you would be so kind, please email me a link to a hacked 
> > page, 

> > > so 

>> >> 

> > > > > some other proof.. This is driving me crazy. 

>P> >>> 

>> >>> 

>> >>> 

>>>>> 


> > > > > Navistar International 
>>>>> 


> > > > > From: 
> > > > > Sent: 
>>> >> То 


> > > > > Subject: Re: Is this a real email address?? 
>> >>> 


> > > > > A site y[ ез hacked... 


>> >>> 
>>>>> мо: 

>> >>> 

>>>>>> 

>>>>>> 

> > > > > > which site was hacked? апа what makes you think it was 
> hacked? 

>> 


> > > > > > From: 
> > > > > > Sent: 
> > > > > > To: 


> > > > > > Subject: Re: Is this a real email address?? 
>> >> >> 


> > > > > > Apparently you didn't understand my response. Your email is 
> > > > > plastered 

> > > > > > all over a website that was hacked, and more importantly, 

> you 


> > > > > > this hacked website. 
>> >>>> 


»»»»»»2[ wrote: 
>>>>>> 


>>>>>>> 
>>>>>>> 


> > > > > > > what makes you think that? 
>>>>>>> 


>>>>>>>---- Original Messaqe----- 
> > > > > > > From 
> > > > > > > Sent: 
>>>>>>>To: 
> > > > > > > Subject: Re: Is this a real email address?? 
>>>>>>> 

> > > > > > > Actually, | would like to be even more specific...... І 
> got 

> > > your 

>> >> 

> > > > > > email 

>>>>>>> 


> > > > > > > address from a hacked website. 
>>>>>>> 


>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > Yes | do... get my email address from whois 


> information? 
>>>>>>>> 


> > > > > > > > ----- Oriqin 
> > > > > > > > From: 
> > > > > > > > Sent 
>>>>>>>>To 
> > > > > > > > Subject: Re: Is this a real email address?? 

PP >>> >>> 

> > > > > > > > Let me ask you something.... .do you have any 

> affiliation 

> > > with 

>>>> 

> > > > > > > > 1115.net? 

>>>>>>>> 

>>>>>>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > This HAS to be the weirdest email | have had in а 
> while. 

>> 

>> >>> >> >> 


> > > > > > > > > Sent: Friday, August 04, 2000 2:10 AM 
>>> >>> >>> То navistar.com 
>>> >>> >>> Su к a real email address?? 


>>>>>>>>> 


>>>>>>>>> If this is а real address please respond... 
>>>>>>>>> 


@sitesmith.com] 


>>>>>>>>>-- 


>>>>>>>>> 


>>>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmith.com 

> > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 


>>>>>>>> 
>>>>>>>>-- 
>>>>>>>> 
>>>>>>>> 


>>>>>>> 
>>>>>>> 
> > > > > > > > wwwssitesmith.com 


> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> m Su 


>>>>>>> 
>>>>>>>-- 
>>>>>>> 


مح >>>>>> 
>>>>>> 

>>>>>> 

> >>>>>>www.sitesmith.com 


> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 
>>>>>>-- 


> > > > > > www.sitesmith.com 
> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 


> > > > www.sitesmith.com 
> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>>> 
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> > > www.sitesmith.com 
> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


> > www.sitesmith.com 

> > "We are the master Internet Craftsmen" 
> > Customer Care Center (888) 898 7667 
>> 

> 

> a 

> 

> 


> w. =. 


> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 


WWW.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


— s 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


From: 
Sent: 
To: 


Subject: ot liking to play nice anymore 


X-Sieve: 
cmu-sieve 1.3 


Return- : 
nav-international.com> 
Re 


from [  Inavistar.com (mail.navistar.com 
С] by mailbo Postfix) 
with ESMTP i for 


р ы; .com>; Mon, 7 Aug 2000 09:25:27 -0700 
DT) 


Received: 
fro ^ ^ havistar.com 
navistar.com [167.6.2.158]) by navistar.com (PMDF 
with ESMTP id 
@navistar.com> for 
sitesmith.com; Mon, 7 Aug 2000 11:27:14 CST 


Rec 
navistar.com with Internet Mail Service 
Mon, 07 

Aug 2000 11:27:09 -0500 
Content-return: 


allowed 
Date: 
Mon, 07 Aug 2000 11:27:06 -0500 
From: 
av-international.com> 
Su : 
RE: Is this a real email address?? 
To: 


Mess - 


ll bspepn3.spr.navistarcom> 


MIME-version: 
1.0 
X-Mailer: 


Internet Mail Service | 
Content-type: 


multipart/alternative; 
boundary="----_= NextPart 001_01C0008C.53A0EA50" 
X-Mozilla-Status: 

9013 
X-Mozilla-Status2: 

00000000 


Pi 


idle threats now... | like. Please refrain from emailing me again 
unless 1), its from your attorney. -or- 2), your willing to provide 
details, such as "Who 


got hacked" "When?" "From who?" "I got your email address from a hacked 


8 


site" (which obviously you didnt, as you already said you got it from 
www.1115.net) "Why you think they were hacked" "Some sort of proof" 
"Proof you have a clue" (most important.) "And anything you can think 
of" 


Thank You 


| 


P.S. If your that worried about your security that you wont provide any 
of these details, follow these instructions: 

1. Unplug the computer from the network. 

2. Shoot yourself in the head. 


Fro sitesmith.com] 


Sent: Monday, August 07, 2000 11:42 AM 
To| | 


Subject: Re: Is this a real email address?? 


= резот" is hacked апа the person that compromised this box 
attacked my client when | emailed you. 1 am going to need records of who 


that domain belongs to and if you are not willing to cooperate, the FBI 
may be involved. 


Фев 


> 
> 
T þiscom.net was МОТ hacked by comandur.com. [ Escomaet IS 


> comandur.com. 
> 


> Thank you. :) 
> 


sitesmith.com] 


> Subject: Re: Is this a real email address?? 
> 


> The site that was hacked waf PEiscom.net, the reason | link you to 


> 


> it is because youard ^  ]ahacker, which means you must 


> have his info. 
> 


L wote: 


> 
>> 


>> 
> > You can link me to being| þecause i am.. 
>> 


> > How you can link me to the compromised site, i have no clue. | dont 
> > know which site is being hacked or was hacked. 


7 » Subject: Re: Is this a real email address?? 


>> 


b6 
BIG 


> > Well, it would be nice to know why | was able to link your name to 
> > both 


> > the compromised site (which 1 can confirm is compromised....ftp in 
> as 


> > anonymous and tell me what you see) and you being | 
>> 
> 


>>> 


>>> 


> > > Оһ.. i see, If there is anything you need from me, let me know. 
>>> 


> > > From: @sitesmith.com] 


> > > Subject: Re: Is this a real email address?? 
>>> 


> > > uh, yeah except the motherfucker is hacking my site. 
> > >, 


>>| wrote: 
>>> 

>>>> 

>>>> 


> > > > correct.. | just dd ^ pomandur.com, whatever content is on 


> 
> > the 

>>> 

> > > > page is his own fault.. 

>>>> 

> > > > afaik iscom.net == comandur.com.. so nothing unusual is 
> > going 

>>> 

> > > > on here. 

>>>> 


> > > > From @sitesmith.com] 


> > > > Subject: Re: Is this a real email address?? 
>>> > 


> > > > Sorry to leave you in the dark. comandur.com !S the hacker, and 


> 
> > you 

>>> 

>> ]him.Solmay need some help from you. The 
> victim 

> > is 

>>> 


> > > > siscom.net ..... check oil  þiscom.net 
>>>> 


>>>> 

>>>>> 

>>>>> 

> > > > > Okay, everything was going good for my day, then уои mention 
> > > this.. 

>> > >> 

> > > > > ... then withhold details, like "One of the 350 websites you 

> > host 

> > > > was 

> > > > > hacked" 
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> > > > > eluding to 1115.net as the site that was hacked.. but yet i 
> can 

> > > find 

>> >> 


> > > > > no signs anywhere... 

>> >>> 

> > > > > If you would be so kind, please email me a link to a hacked 
> > page, 

> > > so 

>> >> 

> > > > > some other proof.. This is driving me crazy. 
>> >>> 

>> > > > Thank 

>>>> 

>> >> 


> > > > > Navistar International 
>>>>> 


>> > > > Se 


> > > > > Subject: Re: is a real email address?? 
>>>>> 


>>>>>Авйеуд ^  ]was hacked... 


>>> >> 
»»»»[— — wrote: 

>>> >> 

>>> >>> 

>>>>>> 

> > > > > > which site was hacked? апа what makes you think it was 


> hacked? 
>> 


oP >> >>> 


> > > > > > -----Original Messade-—- 

<> >>> EE Ln 
> > > > > > Sent: Friday, August 04, Е 

> > > > > > Subject: Rë: Ts This à real email address?? 


>>>>>> 

> > > > > > Apparently you didn't understand my response. Your email is 
> > > > > plastered 

> > > > > > all over a website that was hacked, and more importantly, 


>>> 
>>>" | 
>>> >> 
>>> >> 


> > > > > > this hacked website. 
>>>>> 
s>>>> мов: 
>>>>>> 

>>>>>>> 

>>>>>>> 


> > > > > > > what makes you think that? 
>>>>>>> 


тер == 


> > > > > > > Subject: Ке: Is this a real email address?? 
>>>> >>> 


> > > > > > > Actually, | would like to be even more specific...... l 


b6 


b7C 


> got 
> > > your 
>>>> 


> > > > > > email 
>>>>>>> 


> > > > > > > address from a hacked website. 
>>>>>>> 


>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > Yes | do... get my email address from whois 
> information? 

>>>>>>>> 

> > > > > > > > ----- Original Меѕѕаае----- 

> > > > > > > > From 
> > > > > > > > Sent: 
> > > > > > > > To: 
> > > > > > > > Subject: Re: Is this a real email address?? 
>>>>>>>> 

> > > > > > > > Let me ask you something.... .do you have any 

> affiliation 

> > > with 

>>>> 

> > > > > > > > 1115.net? 

>>>>>>>> 

»»»»»»»» ^ ^ uote: 

>>>>>>>> 

>>>>>>>>> 

>>>>>>>>> ‹ 

> > > > > > > > > This HAS to be the weirdest email | have had їп a 
> while. 

>> 

>>> >>> >>> 


> > > > > > > > > ----- iadinaL Меѕѕаае----- 
12... 
F Í| g p meam] 
т Friday, August 04, 2000 2:10 AM 
Sue ишш; 
>>>>>>> > > Su 716 this a real email address?? 
>>>>>>>>> 
>>>>>>>>> If this is а real address please respond... 
>>>>>>>>> 
> > > > > > > > > -- 
>>>>>>>>> 
>>>>>>>> 
>>>>>>>> 
>>>>>>>> 
> > > > > > > > > www.sitesmith.com 
> > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 


>>>>>>>> 

>>>>>>>>-. 

>>>>>>>> 

>>>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > > www.sitesmith.com 

> > > > > > > > "We are the master Internet Craftsmen" 
> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 

>>>>>>> 

>>>>>>>-- 
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>>>>>>> 


>>>>>>> 
>>>>>>> 

>>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
>>>>>>> 


>>>>>> 

> > > > > > -- 

>>>>>> 

> > > > > > 

>>>>> 

>>>>> 

> > > > > > www.sitesmith.com 

> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


> > > >> Www.sitesmith.com 

> > > > > "We are the master Internet Craftsmen" 
> > > > > Customer Care Center (888) 898 7667 
>>> >> 


> >>> 

> > > > -- 

>>>> 

>>> р 

> > > 

> > > 

> > > > www.sitesmith.com 

> > > > "We аге the master Internet Craftsmen" 
> > > > Customer Care Center (888) 898 7667 
>>>> 

>>> 

>>>-- 

>>> 

>>> 

>> 

>> 

> > > www.sitesmitn.com 

> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 

> > -- 

> > 

> > 

> 

> 

> > WWW.Sitesmith.com 

> > "We аге the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 
>> 


> 
>-- 
> 


> 


13 


> www.sitesmith.com 

> "We are the master Internet Craftsmen" 
> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 
"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


ana 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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From: sitesmith.com] 


Sent: ursday, Augus :34 PM 
To: 

Subject: UUnet getting back to us AGAIN 
X-Sieve: 


cmu-sieve 1.3 
Return-Path: 
sitesmith.com> 
Rec : 
from mailbox.sca1.sitesmith.com (localhost 
by mailbox.sitesmi i 
with ESMTP i Mon, 7 Aug 2000 
08:53:40 -0700 (PDT) 
Delivered-To: 
sitesmith.com 
Received: 
from[ ^ — Kunknown [63.144.153.254]) by 
mailbox.sitesmj ix) with SMTP id 
Or |. Bsitesmith.com»; Mon, 7 
Aug 2000 08:53:30 -0700 (PDT) 
rom: 


F 
L صصص‎ 2 —— 


To: 
[  [ësitesmith.com> 
Date: 
Mon, 7 Aug 2000 11:55:09 -0700 
Message-ID: 


E = com 
-Version: 


1.0 
Content-Type: 
text/plain; charset="iso-8859-1" 
Content-Transfer-Encoding: 
7bit 
X-Priority: 
3 (Normal) 
X-MSMail-Priority: 
Normal 
X-Mailer: 
Microsoft Outlook IMO, Build 9.0.2416 
(9.0.2910.0) 
X-MimeOLE: 
Produced By Microsoft MimeOLE V5.00.2314.1300 
Importance: 
Normal 
Subject: 
[int-wwf] FW: FW: Attack Help / Sitesmith 
(B-TSI-000542086) 
Se : 


sitesmith.com 


sitesmith.com 
X-Mailman- 
1.1 
Precedence: 
bulk 
List-Id: 
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mailbox.sca1.sitesmith.com> b7C 


mailbox.sca1.sitesmith.com 


8001 | 
X-Mozilla-Status2: 
00000000 
X-UIDL: 
8784 


to all... 


-----Original Message----- 
From: UUNET Internet Abuse Investigation] JQUU.NET] 


Sent: Monday, August 07, 2000 8:09 AM 


To: 
Subject: Re: FW: Attack Help / Sitesmith|  — 1] 


** THE RETURN ADDRESSES ON THIS LETTER HAVE BEEN SET TO PREVENT MAIL ** 
** LOOPS IN THE EVENT YOU ARE RUNNING SOFTWARE WHICH AUTO-REPLIES TO ** 
** INBOUND MAIL. UUNET WILL NOT SEE ANY REPLY SENT TO THIS LETTER. ** 

** PLEASE SEND ANY REPLIES TO: ABUSE@UU.NET KEEPING THE SUBJECT LINE ** 
** INTACT. 


Dear Complainant(s): 
This is a follow-up message from the UUNET Internet Abuse Investigations 


Department to let you know the security incident referenced in the 
subject line above was researched and handled according to UUNET's 
Service Agreement with its customers. 


If you wish to pursue legal action against this user, please have the 
authorities contact us for information on where to send a subpoena. 


If you incur additional security incidents that you believe orginate 
from 

a UUNET customer, please report them as seperate incidents to the 
appropriate 

email address below. 


Unless you wish to pursue further action, we will close this incident, 
but 

it can be re-opened at any time by replying to this email or referring 
to 

the ticket? above when calling UUNET Security Support. 


Sincerely, 
UUNET Internet Abuse Investigations Team 1-800-900-0241 
UUNET 3060 Williams Dr., Fairfax, VA 22031 703-206-5440 


security@uu.net - Security Incidents 
http://www.uu.net 
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abuse-mail@uu.net - Massmail 
abuse-news@uu.net - Usenet Abuse 


-Frn| ^ |QUU.NET Fri Aug 4 15:58:43 2000 
>Received: from gen3.ffx.ops.us.uu.net by iaremedy.corp.us.uu.net with 


ESMTP 


> (peer crosschecked as: genjffcopsusuune| | 

> id 

> a Е Fri, 4 Aug 
2000 


15:58:42 -0400 (EDT) 
>Received: from wodc7-2.corprelay.mail.uu.net by gen3.ffx.ops.us.uu.net 
with 
ESMTP 
schecked as: wodc7-2.corprelay.mail.uu.net 


> 


>  for«SECURITYQ)UU.NET»; Fri, 4 Aug 2000 15:58:36 -0400 (EDT) 
>Received: from mailbox.sitesmith.com by wodc7mr2.ffx.ops.us.uu.net with 


ESMTP 
>  (peercrosschecked ар =ë |] 
ШЕ _] 


> for <SECURITY@UU.NET>; Fri, 4 Aug 2000 19:58:21 GMT 
>Received: fron ^ ^ Yunknown 63.144.153.254) 


> by mai i ith.com (Postfix) with SMTP 
> id Fri, 4 Aug.2000 12:56:35 -0700 (PDT) 
>Fro sitesmith.com> 


>To: <SECURITY@UU.NET> 
>c[ ^ Dsitesmith.com» 
>Subject: FW: Attack Help / Sitesmith 


>Date: Fri, 4 Aug 2000 15:57:40 -0700 . 
Message-ID —Bsiesmincom> 
>MIME-Version: 1.0 

>Content-Type: text/plain; 

> charset="iso-8859-1" 

>Content-Transfer-Encoding: 7bit 

2X-Priority: 3 (Normal) 

2X-MSMail-Priority: Normal 

2X-Mailer: Microsoft Outlook IMO, Build 9.0.241 

>X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 
>Importance: Normal 

> 

>Message below: 


>From: @sitesmith.com 
>Sent: Friday, August 04, 2000 3:47 PM 


>To: abuse@uu.net 
>Сс: @sitesmith.com 
>Subject: Attack Help 7 Sitesmi 


>Abuse/UUnet: 

> 

>The following are ACL logs we have gathered from a hacker from the 
following 


>IP address[ ^ ^ 1] The ISP where this originates (SISCOM) is 


not 
>able to assist us at this moment, and won't help in a timely fashion to 
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өзе 


бу‏ ل“ 
e‏ 


deny 
>this IP. 
> 


>If you need additional info aside from the attached logs, please let me 


>know. We are looking for immediate help in denying this IP. 
> 


>You can reach me via email or cell j] 
> 


>Thanks for your help. 
> 


>j 

> 

> 

>----------- Forwarded message ---------- 

>Date: Eri, 4 Aug 2000 11:58:22 -0400 (EDT) 

>From @sitesmith.com> 
>To: s 

obit please take a look (fwd) 


> 
>- — Forwarded message ---------- 


>Date: Fri, 4 Aug 2000 11:43:14 -0400 (EDT) 
>From scammer — —— mih com> 
>To: abuse@siscom.net 


>Subject: please take a look 
> 


> 
> 

>please take a look at the following ACL logs...this has been occuring 
>since about 11:30pm EST...08/03/2000 

> 


>i believe there is an nt4.0 box on your network that is certainly 
>comprimised....and i don't believe that is the only one....one can even 


J n "егі will be....in any case, this is the source 


> 
>thanks, 


> 

> 

>AUG 4 00:23:25 6/1 16921 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:25 6/1 16922 ACL-7: UDP  SrcPort: 137 DestPort: 137 
>AUG 4 00:23:25 6/1 16923 ACL-7: 

>AUG 4 00:23:25 6/1 16924 ACL-7: 

>AUG 4 00:23:25 6/1 16925 ACL-7: 


> 
>AUG 4 00:23:25 6/1 16926 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:25 6/1 16927 АСІ-7; rt: 137 


>AUG 4 00:23:25 6/1 16928 ACL-7 

>AUG 4 00:23:25 6/1 16929 ACL-7 

>AUG 4 00:23:25 6/1 16930 АСІ-7: 

2 

>AUG 4 00:23:25 6/1 16931 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:25 6/1 16932 ACL-7: UDP  SrcPort: 137 DestPort: 137 
>AUG 4 00:23:25 6/1 16933 ACL-7: 

>AUG 4 00:23:25 6/1 16934 ACL-7: 

>AUG 4 00:23:25 6/1 16935 ACL-7: 

> 

>AUG 4 00:23:25 6/1 16936 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:25 6/1 16937 ACL-7: UDP SrcPort: 137 DestPort: 137 
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>AUG 4 00:23:25 6/1 16938 ACL-7: 
>AUG 4 00:23:25 6/1 16939 ACL-7: 
>AUG 4 00:23:25 6/1 16940 ACL-7: 


> 

>AUG 4 00:23:25 6/1 16941 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:25 6/1 16942 ACL-7: UDP SrcPort: 137 DestPort: 137 
>AUG 4 00:23:25 6/1 16943 ACL-7 

>AUG 4 00:23:25 6/1 16944 ACL-7 

>AUG 4 00:23:25 6/1 16945 ACL-7: 

> 


>AUG 4 00:23:25 6/1 16946 ACL-7: NO ACL rule match! Discarding packet 


>AUG 4 00:23:25 6/1 16947 ACL-7: 37 
>AUG 4 00:23:26 6/1 16948 ACL-7 
>AUG 4 00:23:26 6/1 16949 ACL-7 


>AUG 4 00:23:26 6/1 16950 ACL-7: 

> 

>AUG 4 00:23:26 6/1 16951 ACL-7: NO ACL rule match! Discarding packet 
>AUG 4 00:23:26 6/1 16952 ACL-7: UDP SrcPort: 137 DestPort: 137 
>AUG 4 00:23:26 6/1 16953 ACL-7: 

>AUG 4 00:23:26 6/1 16954 ACL-7: 


>AUG 4 00:23:26 6/1 16955 ACL-7: 


w 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


19 


From: 
Sent: 
To: 
Subject: 


X-Mozilla-Status: 
0001 
X-Mozilla-Status2: 
00000000 


Message-ID: 
sitesmith.com> 
ate: 


Mon, 07 Aug 2000 15:10:54 -0400 
From: 


LE Betesmit oom? 
X-Maller: 


Mozilla 4.73 [en] (Windows NT 5.0; U) 
X-Accept-Language: 
en 
MIME-Version: 
1.0 
To: 


| ате 
ubject: 


Re: Is this a real email address?? 
References: 


sprxspn3.spr.navistar.com> 
Content-Type: 
text/plain; charset=us-ascii 
Content-Transfer-Encoding: 
Tbit 


What is your location | 


> 
> 


> idle threats now... I like. Please refrain from emailing me again 

> unless 1), its from your attorney. -or- 2), your willing to provide 

> details, such as "Who got hacked" "When?" "From who?" "| got your 

» email address from a hacked site" (which obviously you didnt, as you 

> already said you got it from www.1115.net) "Why you think they were 

> hacked" "Some sort of proof" "Proof you have a clue" (most important.) 


> "And anything you can think of" 


> P.S. If your that worried about your security that you wont provide 
> any of these details, follow these instructions: 

> 1. Unplug the computer from the network. 

> 2. Shoot yourself in the head. 
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> Subject: Re: Is this a real email address?? 


[com com is hacked and the person that compromised this box 
attacked my client when l emailed you. | am going to need records of 
> who 

> that domain belongs to and if you are not willing to cooperate, the 

> FBI 

> may Бе involved. 

> 

> 

>> 

>> 


> [__fiscom.net was NOT hacked by comendur.com| _ biscomaet 15 
> > comandur.com. 
>> 


> > Thank you. :) 


>> To: 


> > Subject: Re: Is this a real email address?? 
>> 


> > The site that was hacked wa iscom.net, the reason I link you 
E. [ P 


>> 
»»itisbecauseyouar[ ^ D hacker, which means you 


» must 
> > have his info. 
>> 


>> 
>>> 
>>> 


> > > You can link me to being hif ^ ^ þecause i am.. 
>>> 


> > > How you can link me to the compromised site, i have no clue. | 
> dont 


> > know which site is being hacked or was hacked. 
>>> 


>>> 
> > > Well, it would be nice to know why | was able to link your name to 


> 
> > > both 
> > > the compromised site (which | can confirm is compromised....ftp in 


> 
> > as 


> > > anonymous and tell me what you see) and you being Í sd 
>>> 


>>> 
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>>> > 


>> >> 


> > > > Оһ.. i see, If there is anything you need from me, let me know. 
>>>> 


> > > > From @sitesmith.com] 
>> >> S d 2000 1:44 PM 

>>>>T 

> > > > Subject: Re: Is this a real email address?? 

>>> > 


> > > > uh, yeah except the motherfucker is hacking my site. 
>>>> 


>>>> 

>>>>> 

>>>>> 

»»»»»comect.!jus[ ^ ]|сотапайш.сот, whatever content is 
>-on 

>> 

> > > the 

>> >> 


> > > > > page is his own fault.. 
>>>>> 


>>>>> afa piscom.net == comandur.com.. so nothing unusual is 


> 

> > > going 

>> >> 

> > > > > on here. 

>>>>> 

>>>>>----- Oriai 

>>>>> From sitesmith.com] 
>>> > > Sent Eri st 04, 2000 1:29 PM 

> > > > > Subject: Re: Is this a real email address?? 

>> >>> 


> > > > > Sorry to leave you in the dark. comandur.com IS the hacker, 
> and 

>> 

>>> you 

>>>> 

>>>> 4 im. So | may need some help from you. The 
> > victim 

>>> is 


>>>> 
> > > > > siscom.net ..... check о| LS 
>>>>> 


>>>> 
>>>>>> 


>>>>>> 
> > > > > > Okay, everything was going good for ту day, then уои mention 


> 
> > > > this.. 
>>> >>> 


> > > > > > ... then withhold details, like "One of the 350 websites you 


> 

> > > host 

> > > > > was 

> > > > > > hacked" 

>> >>> > 

> > > > > > eluding to 1115.net as the site that was hacked.. but yet i 


22 


Б سن‎ 


- бу 
m 


> > can 
> > > > find 
>>>>> 


> > > > > > no signs anywhere... 

>>>>>> 

> > > > > > If you would be so kind, please email me a link to a hacked 
> > > page, 

> > > > so 

>>>>> 

> > > > > > some other proof.. This is driving me crazy. 
>>>>>> 

> > > > > > Thank You, 

>>>>>> 

>>>>>> 

> > > > > > Navistar International 

>>>>>> 

> > > > > > ----- OriqinaLMessaqe--- 


> > > > > > From sitesmith.com] 


> > > > > > Sent: Friday, August 04, 2000 12:45 PM 
<<<<<< :ا‎ | 


> > > > > > Subject: Re: Is this a real email address?? 
>>> >>> 


>>>>>>Asiteyou ^ ]washacked.. 


> > > > > >, 

>>>>>> 

>>>>>>> 

>>>>>>> 

> > > > > > > which site was hacked? апа what makes you think it was 


> > hacked? 
>>> 


>P> >> >>> 
> > > > > > > ----- Original Message----- 
> > > > > > > Fro 
> > > > > > > Sent 
>>> >>> >T 
> > > > > > > Subject: 
>>>>>>> 

> > > > > > > Apparently you didn't understand my response. Your email 
>is 

> > > > > > plastered 

> > > > > > > all over a website that was hacked, and more importantly, 
> > you 

>> > do 

>>>> 

>>>> 

>>>> 

>>>> 


> > > > > > > this hacked website. 
>>>>>>> 


>>>>>>> 
>>>>>>>> 
>>>>>>>> 


> > > > > > > > what makes you think that? 
>>>>>>>> 


e: Is this a real email address?? 


>> >>> >>> To 


> > > > > > > > Subject: Re: Is this a real email address?? 
>> >>> >>> 


> > > > > > > > Actually, | would like to be even more specific...... | 


> > got 
© 
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> > > > your 
>> >>> 


> > > > > > > email 
>>>>>>>> 


> > > > > > > > address Кот а hacked website. 
> > > > > > > >, 


>>>>>>>> 

>>>>>>>>> 

>>>>>>>>> 

> > > > > > > > > Yes | do... get my email address from whois 
> > information? : 

>>>>>>>>> 

>>>>>>>>>-.--- Oriainal Messaqe----- 

> > > > > > > > > From: 


f @ѕйеѕтіћ.сот] 

> > > > > > > > > Sent: Friday, August 04, 2000 10:59 AM 

<<< <<< <<< 

> > > > > > > > > Subject: Re: Is this a real email address?? 
>>>>>>>>> 

> > > > > > > > > Let me ask уои something.... .do you have апу 
> > affiliation 

> > > > with 

>>>>> 

>>>>>>>>>1115.net? 

>>> >>> >>> 

>>>>>>>>>[ ___ мді: 

>>>>>>>>> 

>>>>>>>>>> 

>>>>>>>>>> 

> > > > > > > > > > This HAS to be the weirdest email | have had in а 


> > while. 
>>> 


>>>>>>>>>> 


>>>>>>>>>>----- OriainaLMessadae----- 


> @sitesmith.com] 
2, 22? >>>>>>>> Sent: Friday, August 04, 2000 2:10 AM 
>> >>> >>> >> ep Enavistaroom 
> > > > > > > > > > Subject: Is this a real email address?? 
>>>>>>>>>> 
>>>>>>>>>> If this is а real address please respond... 
>>>>>>>>>> 
>>>>>>>>>>-. 
>>>>>>>>>> 
>>>>>>>>>> 
>>>>>>>>> 
>>>>>>>>> 
> > > > > > > > > > www.sitesmith.com 
> > > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>>> 


>>>>>>>>> 

>>>>>>>>>-- 

>>>>>>>>> 

>>>>>>>> 

>>>>>>>> 

>>>>>>>> 

> > > > > > > > > www.sitesmitn.com 

> > > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>>> 


>>>>>>>> 
>>>>>>>>-- 


S 


© ل“ 
e‏ 
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>>>>>>>> 


—————————————————— 


> > > > > > > >, 


>>>>>>> 
>>>>>>> 
> > > > > > > > WWAW.SITSITHID.COm 


> > > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > > Customer Care Center (888) 898 7667 
>>>>>>>> 


>>>>>>> 
>>>>>>>-- 

>>>>>>> 

>>>>>>> 

>>>>>> 

>>>>>> 

> > > > > > > www.sitesmith.com 

> > > > > > > "We are the master Internet Craftsmen" 


> > > > > > > Customer Care Center (888) 898 7667 
> >>> >>> 


>>> >>> 
> > > > > > -- 
>>> >>> 
> > > > > > 


>>>>> 
>>>>> 
> > > > > > www.sitesmiin.com 


> > > > > > "We are the master Internet Craftsmen" 


> > > > > > Customer Care Center (888) 898 7667 
>>>>>> 


>>>>> 
>>>>>-- 
>>>>> 
>>>>> 


— n " v .—n N.N çs5ə —  — 


> > > > >| 
> > > > >| 


> > > > > wwwssitesmith.com 
> > > > > "We are the master Internet Craftsmen" 


> > > > > Customer Care Center (888) 898 7667 
>> >>> 


>>>> 
> > > > -- 
>>>> 
>>>> 


>>>> 
>>>> 


> > > > www.sitesmith.com 
> > > > "We are the master Internet Craftsmen" 


> > > > Customer Care Center (888) 898 7667 
>>> > 


>>> 

> > > -- 

>>> 

>>> 

>>> 

>>> 

> > > www.sitesmith.com 

> > > "We are the master Internet Craftsmen" 


> > > Customer Care Center (888) 898 7667 
>>> 


>> 
>>-- 
>> 
>> 
> 


> 


> > www.sitesmith.com bé 
> > "We are the master Internet Craftsmen" 


> > Customer Care Center (888) 898 7667 RU 
>> 


> 
> 
> 


——— . . _  _. 


> 


> "We are the master Internet Craftsmen" 


> Customer Care Center (888) 898 7667 
> 


www.sitesmith.com 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 


— n 


qu d 


"We are the master Internet Craftsmen" 
Customer Care Center (888) 898 7667 
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GEEKTOOLS- WHOIS Proxy http://WWW.geektools.com/cgi-bin/proxy.cgi 


GeekToole(" | 
Whois Р( у | 


PON 


Балоо!) 


ИЙЕ. Fe 


Server used for this query: [ whois.arin.net ] 


SISCOM, Inc. (NETBLK-SISCOM-BLK-1) 
130 W. Second St. Suite 1100 
Dayton, OH 45432 
US 


Netname: SISCOM-BLK-1 


Netblock: 
Maintainer: SISC 


Domain System inverse mapping provided by: 
NS1.SISCOM.NET 

NS2.STSCOM.NET 

ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE 


Record last updated on 26-Apr-1999. 
Database last updated on 27-Nov-2000 06:14:40 EDT. 


Need some help? | 

Results brought to you by Ше GeekTools WHOIS Proxy 

Server results may be copyrighted and are used with permission. 
Proxy @ 1999, 2000 CenterGate Research Group, LLC 

Your host (199.170.71.226) has visited 3 times today. 


Copyright CenterGate Research Group 1998 - 2000 


1 of 2 11/27/00 4:18 PM 


GEEKTOOLS - WHOIS Proxy http://WWW.geektools.com/cgi-bin/proxy.cgi 


— ———— мез у 


S 


бу‏ ل“ 
e‏ 


Server: | - Automatic - 


Whole rR ‘(Оҳу v % ДЕДА 
“N 


Server used for this query: [ wbois.networksolutions.com ] 


Registrant: 

Navistar International Transportation Corp. (NAV-INTERNATIONAL-DOM) 
1901 S. Meyers Rd 
OakBrook Terrace, IL 60181 
US 


Domain Name: NAV-INTERNATIONAL.COM 
Administrative Contact: 


Vistar Internationa 
1901 South Meyers Road 
Oakbrook Terrace, IL 60181 


=== Contact: 
Global Network Management Center  (GNMC) ATTMAIL.COM 
AT&T EasyLink DNS Services 


1111 Wocdsmill Dr. 
Town and Country, MO 63017 
US - 
636-519-5708 Pax- - 800-795-2178 
Billing Contact: 
telecom (TE53- E ا‎ 
Navistar International Transportation 
1901 S Meyers Rd 
Oakbrook Terrace, TL 60181 
US 
630-691-5819 Fax- 630-691-5738 


Record last updated on 23-Feb-2000. 

Record expires on 24-Jan-2002. 

Record created on 24-Jan-2000. 

Database last updated on 27-Nov-2000 13:34:09 EST. 


Domain servers in listed order: 


1 of 2 11/27/00 4:24 PM 


GEEKTOOLS - WHOIS Proxy 


1 of 2 


Whois: | www. 1115.net | 
yee: Server: Г-Айотав- Jv 
KY OO) 


(С ay тов 


Server used for this query: [ whois.opensrs.net ] 


Registrant: 
1115.net 
1115 Linden ave 
Dayton, OH 45410 

US - 


Domain Name: 1115.NET 


Administrative Contact: 


Technical Contact: 


Billing Contact: 


Record last updated on 27-Nov-2000. 
Record expires on 29-Dec-2002. 
Record Created on 29-Dec-1999. 


Need some help? 


11/27/00 5:11 PM 


http://WWW.geektools.com/cgi-bin/proxy.cgi 


http:/ WWW. geektools.com/cgi-bin/proxy.cgi 


Whois:[comandur.com | | еи 
Server: | - Automatic - T bc 
| Whois » | 


PED. 
RB Xy уд, 


e 
en 


Server used for this query: [ whois.networksolutions.com ] 


Registrant: 

comandur.com (COMANDUR-DOM) 
123 No Spam Blvd. 
My TownMy Town, OH 12345 
US 


Domain Name: COMANDUR.COM 
Administrative Contact: 


CoManDuR.Com 
no address 
Urbana OH 43218 


[1] 


y eum — аалчы, Contact: 
Comandur. com 


Record last updated on 03-Aug-2000. 

Record expires оп 12-Jul-2001. 

Record created on 12-Jul-1998. 

Database last updated on 27-Nov-2000 13:34:09 EST. 


Domain servers in listed order: 


Need some help? 
Results brought to you by the GeekTools WHOIS Proxy 
Server results may be copyrighted and are used with permission. 


Proxy © 2000 CenterGate Research Group, LLC 
Your hos has visited 6 times today. 


11/27/00 4:44 PM 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/17/00 


SITESMITH.COM, 450 WEST 15TH STREET, NEW YORK, NEW YORK, 10011, 
telephone number (212)«675-9300 
LIESMIIHECOM, 450,.WEST 15TH STREET, NEW YORK, NEW 


tedÉbhone number (212) 675-9300 email’ 
i "ONT R50 WEST 


aa ca ay 


SF (212) 675- 


VRBES 


cte M 


WR 

“EDERATION, TANFORD, CONNECTICUT, 775% 

ce¥éphone number] SES “STL 

present on a conference call on August 17, 2000. After being , 
advised of the identity of the interviewing agent and the nature = 


of the interview the following information was provided primarily Z 
by unless otherwise noted: f 


advised that he administers the World 
Wrestling Federation (WWF) web-site computers which are 
physically located at LEVEL 3, 111 8TH Avenue, New York, New 
Үогк. |  — —  ]first noticed the attempted intrusion on August 
0, and that he and his coworkers 
viewed the a hack on the WWF system real-time. 


viewed strange packet traffic coming to the WWF system, port 137, 
-— јав able to capture the traffic 
in logs Кер y on August 04, 2000. advised 
that.the IP address is owned by S which“ s an 
in Dayton Ohio, ап e host name isl LStscoM.NET. 


also advised that a reverse IP look-up-associated that 
computer with the domain COMÁNDUR.COM,.,SISCOM^Ss IP address is 


ТУ SEMEL, di. 


part of a block owned by^UUNET. The destination IP address for 
the packets was whic S the virtual IP address for 
WWE. š 2244-А/ ~ 276400 og 


SEDED | 
о eo — 


Investigationon 08/17/00 at Manhattan, New York (telephonically) 
File# 288A-NY-276400 Ü Date dictated 
by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. DX 


сос CES 
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288A-NY-276400 


| 
continuation ofrD-s020f _ | on 08/27/00 rage 2 


advised that he was viewing the web page for Bé 


and that while he was browsing that af saw b7C 
that the time applet was being updated real-time. also 


noticed Ahat the site was being redirected to WWW WHAT -THE ОСК 

ES. .LHLS .. Upon viewing the source’ for t saw the 

e-mag. Pes T s advised that he 
б jp Quar Rs адын 


sep e-mail to this à ress inquiring as to why the user at this 
ore was attempting togati access into the WWF system. 


2 
adviéed that he contacte of 

1115.NET at | 1115.NET provides 

the DNS for SISCOM anid COMANDUR.COM. did not respond 

initially but they toid that he was affiliated with 

1115.net and моца forward the information regarding possible >" 

compromise to COMANDUR.COM.. 


address is sss 


INTERNATIONAL . COM. advised that he confronted 
Via e-mail about t e€ attempted connections, and thát 
responded bY saying that it was not true that im fact 


had h Xd him. dvised that “ie had contacted 
home, on August 4th, 2000, and got^his wi let them 
know their machine may have been compromised. responded 


that the machine was taken offline but found no evidence that the 
machine was compromised. 


ГГ advisea that he attempted to explain the 
problem to UUNET and asked UUNET to block to which 
UUNET replied that they don't block IP addresses. further 


explained to UUNET why they should block the IP address to which 
UUNET said they would block it, but never actually did. 

went on to advise that he contac hosted the WWE 
Servers, and asked them to block at the router. 
Level 3 was able to block vised that 
in order to get to the source of the trouble logged on 


to ا‎ an anonymous FTP connection and he 
foun acker tools on the machine. 


( þovisea that the WWF site gets 25 million hits 


FD-302a (Rev. 10-6-95) 


288A-NY-276400 


a day and it is a load balancing set-up so if packets are 
flooding the system web hits will be lost. Millions ОЁ dollars 


have been lost due to Wese system А «О. 
also advised that 10 days*Before the WWF 
Я s 


server s actually, |compromise8d. Hacking tools меге,” 
found on | One 
of the tools that was foundon the sites was М.?АР which ,etased 


logs. ===] also айуубеа that te binaries were modified and 
that the hash, PS, Net- #E=Stat were also,tfiodified. 

advised that of SITESMITH/in the United 
Kingdom may have information regarding the earlier hack. 


CC advised that he forward all pertinent logs 
and e-mails. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 02/27/2001 
To: New York 


From: New York 
C-37 


Approved By: [ 1 111] 


Case ID dí: 288A-NY-276400 
288H-NY-C276302 


Title:  UNSUB(S); 
SITESMITH.COM; 
WORLD WRESTLING FEDERATION 
(WWP) - VICTIM; 
NIPCIP 
OO:NY 


Synopsis: To record statistical accomplishments. 

Details: To record statistical accomplishments for the above 
captioned case. 

Accomplishment Information: 

Number: 1 

Type: МІРСІР SUBJECT IDENTIFIED 


ITU: NIPCIP 
Claimed By: 


SSN: 
Name: 


Squad: C37 


%% 
2Л16Цо0 
26h -NN- 
UPLOADED = 
WITH/TEXT ав С crews f 
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In Reply, Please Refer to 


File No. 288A-NY-276400 


FBI CASE STATUS FORM 


Date: 02/27/2001 


To: United States Attorney MaryJo White 
(Name and Address of USA) 


From: Special Aqent in 


(Name of Official in Charge .and Field Division) (Signature of Official in Charge) 


RE: World Wide Wrestling Federation Website | 
(Name of Subject) Age Sex 


You are hereby advised of action authorized by AUSA 
(Name of USA or AUSA) 


on information submitted by Special Agent SA С] o — 02/27/01 


(Name) (Date) b6 
POTC 
` 


(Check One) 


Request further investigation 


О 


Immediate declination 


El 


Filing of complaint 
Presentation to Federal Grand Jury 


Filing of information 


Other 


OOO d 


For violation of Tite 18 , USC, Sections) 1030 


Synopsis of case: As per 02/27/01 conversation with duo ACT 

Lo case is being closed, at this time, due to a lack of 
sufficient log file evidence that meets the prosecutory 
guidelines under Title 18 Section 1030. 


2494 Ny- 276 Yo, 


FEB 2 8 2001 
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Г speciil Handling Instructions | 
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O Collected at Scene Ù- Recovered 
LI Seized L1 Contributed 


C] Batteries ГГ Biohazard [_] Computer а/ 7] Zo% 
Ci ЕС} ГІ Firearms [C] HAZMAT 
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LAW OFFICES OF 
COWDERY, ECKER & MURPHY, L.L.C. 


750 MAIN STREET 


HARTFORD, CONNECTICUT 06103-2708 


www.cemlaw.com 


TELEPHONE (860) 278-5555 
FACSIMILE (860) 249-0012 


Or COUNSEL 


September 6, 2006 


BY FEDERAL EXPRESS 


Esq. 
Assistant U.S. Attorney 
United States Attorney’s Office 
915 Lafayette Boulevard 
Bridgeport, CT 06915 


Re: SSAT Sub oena to Attorneys 
DearL___} 


Enclosed are the original signed declarations of Attorneys 
[ — Jaa with accompanying 


exhibits. 


Very truly yours, 


Enclosure 
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DECLARATION OF = 
[pursuant to 28 U.S.C. § 1746, declares as follows: ыы 


b7C 


Executed on September 5, 2006 
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DECLARATION ОЕ 12 
фа to 28 U.S.C. $ 1746, declares as follows: DE 


Executed on September 5, 2006 
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Title and Character of Case: 


b3 
BELL CONSULTING xis 
A b7C 
Date Property Acquired: Source from which EI Acquired: 
09/07/2006 i 
Anticipated Disposition: — x Case Agent: 
Description of Property: Date Entered 
1B 14 
COVER LETTER F b3 
DECLARATION OF (ORIGINAL) b6 
DECLARATION OF (ORIGINAL) 7с 
EXHIBITS TO DECLARATIONS OF ATTY[ ДАМ 
ATTORNEY 
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Owning Office: NEW HAVEN 
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CJ Other [Kl None 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 01/17/2002 

To: Counterterrorism Att.: Computer Investigations 
Unit, CIOS, NIPC, 
Room 11719 


From: SAC, New York 


approved ву: — — — — — ]^ 


Case ID 1d: 288A-NY- 


Title: Subject:  UNSUB(S); 
Victim: WORLD WRESTLING FEDERATION 
WWW. WWF . COM 
Type: DENIAL OF SERVICE 
Date: 01/16/2002 


SUBMISSION: X Initial O Supplemental O Closed 
CASE OPENED: 01/17/2002 


CASE CLOSED: |. Jj 


O No action due to state/local prosecution 
(Name/Number ) 

О USA declination 

O Referred to Another Federal Agency 

(Name/Number: ) 
[] Placed in unaddressed work 

O Closed administratively 

O Conviction 


COORDINATION: FBI Field Office 
Government Agency 
Private Corporation Mediachron, 509 Westport Ave. 
Norwalk, CT 06851 


Company name/Government agency: World Wrestling Federation (WWF) 
Address/location: Stamford, CT 


Purpose of System: Internet webserver for the site WWW.WWÍ.com 
` Highest classification of information stored in system: Unclassified, confidential. 


rjAN 1 7 2002 


x 


% 


` To: Counterterrorism 


From: SAC, New York 
Re: 288A-NY- , Date 01/17/2002 


System Data: 
Hardware/configuration (CPU): Cisco Routers, Sun Webservers 
Operating System: Linux 
Software: 


Security Features: 


Security Software Installed: X yes (identify ) О no 
Logon Warning Banner: O yes O no 


INTRUSION INFORMATION 
Access for intrusion: X Internet connection L] dial-up number O LAN (insider) 
If Internet: Internet address: Undetermined 


Network name: 


Method: 
Technique(s) used in intrusion: Denial of Service - SYN Flood 


Path of intrusion: 


addresses: 1. 2. 3. 4. 5. 
country: 1. 2. 3, 4. 5. 
facility: 1. 2. 3. 4. 5. 
Subject: 
Age: Race: 
Sex: Education: 
Alias(s): Motive: 
Group Affiliation: 
Employer: 
Known Accomplices: 
Equipment used: B 
Hardware/configuration (CPU): 
Operating System: 
Software: 
Impact: 


Compromise of classified information: ГІ yes X по 
Estimated number of computers affected: 1 webserver affected, 9 servers at risk. 
Estimated dollar loss to date: Undetermined - Potential losses of $80K per day. 


x 


To: Counterterrorism | 
From: SAC, New York 


Re: 288A-NY- , Date 01/17/2002 
Category of Crime: 
Impairment: Theft of Information: 
ПІ Malicious code inserted O Classified information compromised 
X Denial of service О Unclassified information compromised 
O Destruction of information/software [] Passwords obtained 


O Modification of information/software O Computer processing time obtained 
O Telephone services obtained 
O Application software obtained 


Г1 Operating software obtained 
Intrusion: 


[] Unauthorized access 
[] Exceeding authorized access 


REMARKS 
Starting on 01/15/2002 technicians for Mediachron, the Internet website vendor for the WWE, 
experienced several DOS attacks of 2 to 3 minutes each on one of the webservers servicing the 
popular website www.wwf.com. The site generates revenues of approx. $80K per day. The 
attacks consumed the full capacity of the two 1 Gigabyte lines servicing the WWF's bank of 
webservers. The servers are located at Level3 computing, located in New York City. Efforts by 
Mediachron to trace the source IP addresses of the attacks revealed that numerous different IP 
numbers were coming in on a SYN Flood. Those IP numbers may have been spoofed because 
attempts to perform trace route and whois lookup on the numbers met with negative results. 
Mediachron is taking efforts to further monitor suspicious traffic and attempt to locate the 
offending computers. WWF is planning a large pay per view event on 1/20/2002, and there is 
concern that the few short attacks may be a prelude to a larger, sustained attack during the 
upcoming event. The initial complaint was forwarded from the New Haven Field Office 
because the WWE servers reside in New York City. 
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Universal Case File Number 2.£€4- Jt-2glzo| 


Field Office Acquiring Evidence [Vew or K 


Serial # of Originating Document ) и 
Date Received 2] / 7 / OA. 
From ! 
(Name of Contributor) 
=== этш лы сушы а шз уте 


(Address of Contributor) 


By 3 


To Be Returned `O Yes XNo 
Receipt Given 0 Yes Мо 
Grand Jury Material - Disseminate Only Pursuant 
to Rule 6 (e), Federal Rules of Criminal Procedure 
О Yes ANo | š 
Title: UASB CS) 
Ws — Ce e 
ЖЕП, 
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Reference: 
(Communication Enclosing Material) 


Description: Original notes re interview of 


— PAAR 


"d ra 
@ U.S. Department 6... 


Federal Bureau of Investigation 
FBI - New York 

26 Federal Plaza, 23rd Floor 
New York, NY 10278 

Phone: (212) 384-1000 


September 24, 2003 


World Wrestling Entertainment 
1241 East Main Street Connecticut 
Stamford, CT 06902 


RE: Case Number 288A-NY-281221 ; 


LE 


The Victim Assistance Program at the Federal Bureau of Investigation has received your name as a 
possible victim of a federal crime. Victims of federal crimes are entitled to certain rights under the law, 
including the right to notification of the status of the investigation. я 


We would like to таке you aware of фе victim services that тау be available to you and to resolve апу 
questions you may have regarding the criminal justice process throughout this Investigation. Bit 


The enclosed information provides instructions for accessing the Victim Notification System Call Center. 


Ш need a Victim Identi ion Number (ID) and Personal Identification Number (PIN). Your ID is 
and your PIN i be 


This investigation is continuing. You will be notified when an arrest has been made or prosecution has 
been declined. 


The Victim Notification System (VNS) is designed to provide you with information regarding the status of 
the investigation. You may use the Victim Identification Number and Personal Identification Number 
(PIN) which has been assigned to you to telephone the VNS Call Center (1-866-DOJ-4YOU*) or (1-866- 
365-4968*), TDD/TTY users call 1-866-228-4619, and obtain the current status of the investigation. In 
addition, you may call the toll-free number and speak with an operator to update your contact information 
and/or change your decision about participation in the notification program. 


We have enclosed some information regarding your rights. You may also feel free to contact the Victim 
Assistance Program if you have any questions or concerns. 


Victim Specialist Victim Specialist m та E 


*For international callers, 1-502-213-2767. | OCT 05 2003 “о 
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iq 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01/25/2002 

b6 
work telephone ES 
number was interviewed telephonically. After being 
advise i ity of the interviewing agent and the purpose 


of the interview, He provided the following informatign: 


06902. WWF maintains its computer servers at LEyEL 3, 85 10th 
a New York, New York. Thel | | | | | |WWF at LEVEL 3 


is telephone number 


On 01/15/2002 at approximately 2:00 pm, WWF experienced 
a DDOS attack against their computer servers. Specifically, the 
server that acts as the front end for the WWF's Internet site was 
the victim of a SYN flood attack. A SYN flood attack brings so 
much illegitimate traffic to a server that the server becomes 
overloaded while attempting to process the illegitimate SYN ғ 
traffic. Тһе attack consisted of approximately 50 megabytes of 
illegitimate inbound traffic aimed at the front end server. This 
attack resulted in the WWF's web site being able to only handle 
about 1000 legitimate requests per second, as compared to the 
normal 8000 requests per second. Basically, the web site was 
slowed down to the point where it was almost non-functioning. 
The attack lasted for approximately 45 minutes. 


On 01/16/2002 at approximately 6:49 am, the WWF server 
again was attacked in the same manner. In this attack, the 
server received between approximately 200-400 megabytes of 
illegitimate inbound traffic, slowing the server down even more. 
This attack lasted approximately 10 minutes. 


The WWF web servers contain not only information about 
the WWF, but also have advertisements, as well as contests and 
the ability to sign up for the various WWF pay-par-view events. 
The WWF also has the ability to broadcast its pay-per-view events 
over the Internet. WWF had a large pay-per-view event scheduled 
for the weekend of 01/19/2002. ear was that the 
attacks would target the event, and cause the paying customers to 


-Y-28122] — 


Investigationon 01/24/2002 at Melville, New York 


File# 288A-NY-281221 


by 


This document contains neither recommendations nor conclusions ihs PR J {5 the 
it and its contents are not to be distributed outside your agericy: : 
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288A-NY-281221 


Continuation of FD-302 of | | ‚Оп 01 /24 / 2002 , Page — 


not be able to view the event. Fortunately, there were no 
attacks during the pay-per-view event. 


[ Jana his staff put many defenses in place to 
prevent the attacks from occurring again. These defenses 
included splitting the incoming traffic to different servers, 
modifying the software on their intrusion detection systems (IDS) 
and adding more monitoring devices on the servers. WWF also had 
to employ a third party contracting service to help with these 
tasks. All this led to a substantial monetary output for the 
WWF. The actual advertising and pay-per-view subscriber money 
loss due to the web site being down is still being calculated, 
and will be provided at a future date. 


Due large amounts of data that was directed at 
the WWF К аа. the attack was done by a hacker(s) 
that has compromised a system with a large amount of computing 
power, such as a University or a business. 
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Precedence: ROUTINE Date: 10/18/2002 
To: New York 
From: New York bé 
Squad C-37 pic 
Contact: SA 
Approved By: 
Drafted By: | (сим 
Case ID d: 288A-NY-281221 (Pending) 
Title:  UNSUB(S); 
WORLD WRESTLING FEDERATION - VICTIM; 
NIPCIP; 
OO:NY 
Synopsis: Writer recommends case be closed. 
Details: Writer respectfully requests case be closed due to x) 
insufficient evidence, as well as no new leads developing. Pd 
p баа 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 
To: New York 
From: New York 
C-37 
Contact: SAL 
@ 
Approved By: [—— p° 


Case ID #: V288A-NY-281221 (Closed) 


Title: 


Synopsis: 


Reference: 


Details: 


CAgtName: 
PContact: 
BusName 
BusEIN 
BusAcct 
VicFirN 
VicMidN 
VicLastN: 
SSAN 
VicDate 
VicDOD 
VicMinor: 
DOB 

Race 

Sex 

Addr 
City 
State 
Country 
Zip 
Email 
HPhone 
VWrkAddr: 
VWrkCity: 
VWrkSt 


(АЛӘ, 1 


188В-МҮ-266547 


VICTIM NOTIFICATION FORM 


To identify victim in captioned case. 


288A-NY-281221 Serial 1 


E 


Business 
World Wrestling Violation 
000000000 


20020115 


1241 East Main Street Connecticut 
Stamford 
CT 


05/15/2003 


MAY 15 2005 


“ЕБІ — NEW YORK 
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UE ware е = 


To: 
Re: 


VWrkCtry: 


VWrkZip 
WPhone 


VicPager: 


NOKFirN 
NOKMidN 


NOKLastN: 


NOKRe 1 
NOKAddr 
NOKCity 


NOKState: 


NOKCtry 
NOKZip 

NOKHPho 
NOKWPho 


NORPager: 


GrdFirN 
GrdMidN 


GrdLastN: 


GrdRel 
GrdAddr 
GrdCity 


GrdState: 


GrdCtry 
GrdZip 

GrdHPho 
GrdWPho 


GrdPager: 


PropRet 
TotLoss 
Lang. 

Disable 
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! NH 1 ! ORIGINAL NOTES OF FORENSIC EXAM ONE PAGE OF NOTES, FOUR PAGE ! 
! ! S OF ADMIN NOTES ONE DISC l 
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! NH 6 1 ORIGINAL NOTES RE INTERVIEW OF[ ^ _ ]a0/28/2005) 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/02/2004 


To: New Haven Attn: sa[ sd 


From: New Haven 


BRA-1 b6 
Drafted By: [дав 
Case ID #: 196D-NH-42441 - (Pending) 10 
66F-NH-A37717 (Pending) H) 

Title: 

BELL CONSULTING, 

BELL LICENSING; 

(SSAT) ; 
j - (WWE) - VICTIM; 

FBW: 
Synopsis: Request New Haven Division CART Field Examiner provide b3 FGJ 
CART assistance and forensic examination | ee] 


obtained from victim in this matter. 


Details: [was Гг Б Licensing at à 
WWE and in that capacity, it was one of his[ 1 
for the WWE. He was strictly a 
salaried employee and according to an employee agreement, he was 
not eligible for any type of commission payment for licensing 
business he generated. 


Additionall the WWE also entered into an agreement 

e the outside licensing agent 

for the WWE. Unlike was not salaried but did 

receive commissions on licensing business he brought to the WWE. 
was not entitled to commissions on licensing business 


procured by the WWE оп its own, independent of SSAI. 


E] while employed by the WWE, formed[ 1 
Be 


Consultin and entered into an agreement with 
иззат) whereby i а potential licensees which 
ad not been developed by to SSAI. It would thus appear 
that SSAI had generated the resulting licensing business and SSAI 


would receive a commission from the WWE. Thus, WWE was paying a 
commission it should have not had to pay. In return for 


1 


with 


t 


f 


gs 


H 
iu 0299 “с 
Sy (А 


1 


moO МОТ 


To: New Haven From: New Haven 
Re: 196D-NH-42441, 03/02/2004 


directing the business through ssai,[ ^ [уза Bell Consulting, 
received a kickback from SSAI representing half of the commission 
paid to SSAI by WWE. 


lL  ]issan also arranged for payment from at least 


one WWE licensee in exchange for rous licensing agreement. 
That payment was also shared wil | 


Additionally,[  ]manufactured phoney invoices to 
account for monies paid to Bell Consulting by SSAI іп furtherance 
of the fraud and illegal activity they were conducting. 


Via federal grand jury subpoena issued on the WWE, New 


Haven has 


b3 FGJ 


To: New Haven From: New Haven 
Re: 196D-NH-42441, 03/02/2004 


LEAD (s): 
Set Lead 1: (Action) 
NEW HAVEN 


AT NEW HAVEN 


Request New Haven Division CART Field Examiner provide 
CART assistance and forensic examination in suppo 
investigation. It is specificall 
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September 3, 2004 


Special Адеп | 


ЕВ! 
1000 Lafayette Boulevard 
Bridgeport, CT 06604 


Dear Special Agen| | 


Please find the executed consent form received from 2 pffice for 
forensic analysis of the computers obtained from Price Waterhouse Coopers. 


| would like to request if it'išzat all.ñossible-for meto receive copies of the hard 
drive copies. Since you are capable, of making, Copies. апа уои have the 
machines in your possessioh."These have'béen' out of my'possession for over 
eight months and there are,some business records l need for my clients. 
Perhaps you and can work this:out: These were seized by WWE 
without notice and we were unable to make any file back-ups. 


Sincerely yours, 


US Assistant United States Attorney 


File 


U.S. Department-of Justice——— —əÀ+>*x — — — s V —— 


United States Attorney 
District of Connecticut 


— mr D H — M —MM ——— —— ——— À— € 


Brien McMahon Federal Building (203) 696-3000 
915 Lafayette Boulevard, Room 309 Fax (203) 579-5575 
Bridgeport, Connecticut 06604 www.usdoj. gov/usao/ct 
August 20, 2004 


Re: United States v| | 


I received your voice mail today. Thank you. Enclosed please find a Consent for the 
forensic analysis of the computers obtained from PriceWaterhouseCoopers. Please ask your 
client to execute the consent and forward it to Special Age] | at the FBI, 1000 
Lafayette Boulevard, Bridgeport, Connecticut 06604. 


Very truly yours, 


KEVIN J. CCONNÓR 
TED'STATES ATTÓRN 
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FEDERAL BUREAU OF INVESTIGATION 


CONSENT TO SEARCH 


1. I have been asked by Special Agents of the Federal Bureau of 
Investigation to permit a complete search of: 


(Describe the person(s), place(s), or thing(s) to be searched. 


2. І have been advised of my right to refuse consent. 


3. I give is permission voluntarily. 


4. I authorize these agents to take any items which they determine may 


be related to their investigation. 
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lL | for WWE's brand. 
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& Print Entire F 
Decide with Confidence D-U-N-S® Number 10-689-7189 Gal E-mail Repor oy 
Copyright 2005 Dun & Bradstreet - Provided under contract for the exclusive use of la Save Text Re b7C 
subscriber 2637 EF Save HTMLR 
ATTN: Report Printed: ОСТ 25 2005 =] Export Data 
In Date 
Back To Report Archive ; 
" Historv& Ф Government 3 Banking & 
*New Search Overview Г Operat ons  j Activity Payments finance 
` OVERVIEW BUSINESS SUMMARY IM About Business Su 
p Business Summary 
» Government Activity PB&J DESIGN, INC 


Summary | РВ&) LICENSING А 
+ Summary Analysis 273 Canal St, Suite 222suite 222: .. 


& Customer Service Shelton, CT 06484 
HISTORY & OPERATIONS ° I 2 Suv 

Histor This is a single location. RA" ӨЙ D-U-N-S Number: 10-689-7189 

Business Registration Web site: bidesian 

Operations site; — соп SIC: 7336 

SIC & NAICS =s = 

оу ылу . Telephone: 203 924-8212. «Jump to: SIC & NAI 
GOVERNMENT ACTIVITY - li Section 
PAYMENTS . Chief executive: PORTER MCKINNON, PRESIDENT 

D&B PAYDEX ` | Line of business: Commercial art 


Payment Summary Year started: 2000 andgraphic design 


Payment_Details 


BANKING & FINANCE Employs: 4 (S D&B Rating: == 
Finance f Е . : гу 
Sales: $350,000 ERES RES 
PUBLIC FILINGS қ бесі 
History: CLEAR du 222 0 ection 
` WEB RESOURCES . Jump to: Finance Secti "e 
ч Business's Web Site (3) D&B PAYDEXG: 
BUY OTHER D&B 
PRODUCTS 12-Month D&B PAYDEX: 80 


Global Family Linkage 
Comprehensive Report 


When weighted by dollar amount, payments 
suppliers average generally within terms. 


Higher Risk Score Report 
Industry Norms Report 
Supplier Evaluation Report 


MORE D&B RESOURCES 


Patriot Act Compliance 
Solutions 


Identity Verification Based on trade collected over last 12 months. 
Services D&B PAYDEX Key 


Ш High risk of late payment 
(average 30 to 120 days beyond term 


e [1 Medium risk of late payment‏ ن 
(average 30 days or less beyond term‏ 


W Low risk of late payment 
(average prompt to 30+ days sooner) 


*Jump to: Payments S 


120 days slow 30dayssiow Prompt Antich 


» Full Glossary of Terms 
- Interpreting D&B Ratings and Scores 
` «Understanding Financial Statements 


ІР About Government Activity Su 


More resources from D&B: 


GOVERNMENT ACTIVITY SUMMARY 


Identification summary 
Public Company: N/A 


° D&B*Federal Information Report: PB&J DESIGN, INC Page 2 of 2 


Public Company: N/A 

Congressional District: ` 04, 03 

Importer/Exporter: N/A 
Possible candidate for socio-economic program consideration 

Labor surplus area: N/A 

Small Business: YES (2005) 

Woman-owned: N/A 

Minority-owned: , N/A 

8(A) firm: N/A 


The details provided in the Government Activity section are as reported to Dun & Bradstreet by the fe 
government and other sources. 


More resources from D&B: - . Patriot Act Compliance Solutions 
- Identity Verification Services 


SUMMARY ANALYSIS š G About Summary А 


ІЗ D&B Rating: -- 20 

The blank rating symbol should not be interpreted as indicating that credit should be denied. It simpl 
means that the informatión available to D&B does not permit us to classify the company within our ra 
key and that further enquiry should be made before reaching a decision. Some reasons for using a "- 
symbol include: deficit net worth, bankruptcy proceedings, insufficient payment information, or inco 
history information. For more information, see the D&B Rating Key. 


Below is an overview of thé cómpany's rating history since 04/15/03: 


D&B Rating Date Applied 
-- 04/15/03 


The Summary Analysis section reflects information in D&B's file as of October 24, 2005. 


More resources from D&B:  - D&B Rating Key Safeguard Your Company #0 
Potential Risk or Loss 
Special Discount with this Ратна 


+ Interpreting D&B Ratings and Scores 


ies 


war av vibe st coss 
taal fus rye ae 
CUSTOMER SERVICE aes rua b iani oc 
' t au te fr] celte ab кас” 
If you have questions about this repórt, please call our Government Services Office at 1,800.424.249 
our Customer Resource Centér at 1.800.234.3867 from anywhere within the U.S. 


~Outside.the.US.-orfor.more-specificquestions,.please.contact.the-D&B.Government-Services-Office-a 


703.276.7856 or by e-mail at govt@dnb.com. T" | 7 . 
: Overview . History & Operations E overnment Activity. Payments I Banking & Finance . Public F 
4Back to Report Archive Print Entire Report Елі Барон” Save Text Report Save HTML Report Export Data 
New Search Order an investigation Tell Us What You Think 


Copyright 2005 Dun & Bradstreet - Provided:under contract for the exclusive use of subscriber 2637390571. 


Company Reports | Basic Marketing Lookups | US Public Records Search:| Country Risk Services | ZapData | Global Family Linkage | Global Mark 


Home | DUNSRight™ | FAQs | Customer Assistance | Samples and Descriptions.| Price Guide | About Privacy 


* D&B Federal Information Report: PB&J DESIGN, INC 


| Decide with Confidence 


4Васк To Report Archive 
4New Search 


` OVERVIEW 
Business Summary 
Government Activity 
Summary 


Summary Analysis 
Customer Service 


HISTORY & 
. OPERATIONS 
* History 
& Business Registration 
* Operations 
¢ SIC & NAICS 


GOVERNMENT ACTIVITY 


PAYMENTS 
D&B PAYDEX 


Payment Summary 
Payment Details 


BANKING & FINANCE 
Finance 


PUBLIC FILINGS 


' WEB RESOURCES 
x Business's Web Site 


BUY OTHER D&B 
PRODUCTS 
Global Family Linkage 
Comprehensive Report 
Higher Risk Score Report 
Industry Norms Report 
Supplier Evaluation Report 


MORE D&B RESOURCES 


Patriot Act Compliance 
Solutions 


Identity Verification 


Services 
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PB8J DESIGN, INC & Print Entire 
D-U-N-S® Number 10- -689-7189 ‘E E-mail Repor 
Copyright 2005 Dun & Bradstreet - Provided under contract for the exclusive use of E Save Text Re 
subscriber 263739057L ‘EP Save HTML R 
Am[ | Report Printed: ОСТ 25 2005 =] Export Data 


In Date 


History & 


Government 
Operations 


Т Banking & 
_ Activity 


Finance 


Overview Payments 


HISTORY 
The following information was reported 03/15/2005: 


Officer(s): 


DIRECTOR(S): THE OFFICER(S) and:Corporate details under investigation. 


Corporate details under investigation. 
Business started 2000. 25%-оҒ capital stock:is owned by Porter McKinnon. 25% of capital stock is ow 


by Jason Walker. 25% of capital stock is, owned by Daniele DiSorbo. 25% of capital stock is owned by 
Beresford Grant. 


; 1 2000 - present PB8J pecan ine: 

A 400 D EA 

>* 1] 2000 - present PBSI pecan; Tae Shelton, CT. 
[poo ові peas дей, Ine. 


; [ | 2000: f preseit-PB8À Design, Inc. 


2 About Business Regis 


CORPORATE AND BUSINESS REGISTRATIONS PROVIDED BY MANAGEMENT OR OTHER SOURCE 


BUSINESS REGISTRATION 


The Corporate Details provided below ‚тау have been submitted by the management of the subject 
business and may not have Бёеп уёгійёа With the government agency which records such data. 


чу 


Registered Name: PB8J Design, Inc 


З ТЫВА ы ы 


CORPORATION |` 


бі 


Business type: x 

Corporation type: -PROFIT | 

State of incorporation: CONNECTICUT 

Filing date: MAR;04.2004 

Status: ACTIVE 

Where filed: SECRETARY-OF STATE/CORPORATIONS DIVISION, HARTFORD, CT 
OPERATIONS EH 3 About Ope 
03/15/2005 фы 


Description: Engaged in commercial artxand graphic design. 
ADDITIONAL TELEPHONE NUMBER(S): Facsimile (Fax) 203 924-8214. 


Terms are net 30-days..'Sells to manufacturers, general public and commercial concern 


° D&B Federal Information Report: PB&J DESIGN, INC Page 2 of2 
Terms are nêt Зо. days. Sells to manufacturers, general public and НЛО сопсегп 
Territory : United States. 


Employees: 4 which includes officer(s). 


pU es s 


Facilities: Rents 850 sq. ft. on 2nd floor of 1 story brick building. 


' Prek мат و‎ 
For more details on the corporateifamily:of-this business, use D&B's Global Family Linkage product. 


SIC & NAICS [Б] About SIC в 
P SIC: a I NAICS: 


Based on information in our file, D&B has assigned 541430 Graphic Design Services 
this company an extended 8-digit SIC. D&B's use 
of 8- -digit SICs enables us to be more specific to a 
company's operations than if. wé-use the standard 
4-digit code. Deg С degen 
The 4-digit SIC numbers ТЕЗ ne description on 
the Occupational Safety & Health Administration 
(OSHA) Web site. Links open im anew browser 
window. 
abs 


73360000 Commercial art hid graphic design 


————— Se a ши аала ые аа ае 


ven à ҮҮ 
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4Back to Report Archive Print Entire Report , E- mail Report Save Text Report Save HTML Report ExportData 
*New Search ü Order an Investigation Tell Us What You Think 
4 


Copyright 2005 Dun & Bradstreet - Provided. шаг contract for Ше exclusive use of subscriber 2637390571. 


edu out 


Company Reports | Basic Marketing Lookups | US Public Records Search: | SEA Risk Services | ZapData | Global Family Linkage | Global Mark 
Home | DUNSRight™ | FAQs | Customer Assistance | Samples-and Déscriptions | Price Guide | About Privacy 


ald 


Mey 000 Went br On < PA uring he. 
WWE made POE aul 


аі O] TE 

2 E ЖО аталса 
EN 57 2. — 
D DATEN жш ш 


\2/4 Гас — 


ajos. iie +) 
“әсәм i име. < 4 


FD-340 (7-19-00) 


Universal Case File Number 
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Serial # of Originating Document | a TS 

Date Received | og [a| 100 £ | 
s= s E E M ee x 


Erom 
(Name of Contributor) 


(Address of Contributor) 


By 
To Be Returned ІП Yes 
. Receipt Given H LT No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
L] Yes [2 No 
Federal Taxpayer Information (FTI) 
L] ves am 


Title: | аа 
Abo : 
ev) Жеттім Сүм” ` 


5 u 


(Communication Enclosing Material) 


Description: Г] Original notes re interview of 
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FD-395 (Rev. 2-28-97) 


willing to answer questions 


Witness: 


ADVICE OF RIGHTS 
Place 7 ven (vc 
Date 
Time y 
YOUR RIGHTS 


Before we ask you any questions, you must understand your rights. 

You have the right to remain silent. 

Anything you say can be used against you in court. O. ELS vog 
SAN WAN P 

You have the right to talk to a lawyer for advice before we ask you any questions. 

You have the right to have a lawyer with you during questioning. 

If you cannot afford a lawyer, one will be appointed for you before any questioning if you wish. 


If you decide to answer questions now without a lawyer present, you have the right to stop 
answering at any time. 


WAIVER OF RIGHTS 


I have read this statement of my ПЕШ and I YE 


Witness: 


Time: q: < Pw | 


FD-340 (7-19-00) 


— | 0 (o D vd М ~ ¢2 » | 


Field Office Acquiring Evidence 


Serial # of Originating Document 
Date Received © 9 [28| LD 7 
ا‎ Ar sm 


Erom | 
: (Мате of Contributor) 4 
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(Address of Contributor) 


By SA 


ToBeRetumed C] Yes N To 


Receipt Given Û] No 
Grand Jury Material - Disseminate Ош! tto Rule 6 (e) 
Federal Rules of Criminal Procedure : 


П Yes . K No : 
Federal Taxpayer Information (FTI) | | 


Alon 


NNR WCU ENDS ant 
(ew | 


Title: 


Reference: 
(Communication Enclosing Material) 


Description: Г] Original notes ге interview of. 
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FD-395 (Rev. 2-28-97) 


willing to answer questions «wie 


Witness ы S бе 


ADVICE OF RIGHTS 


YOUR RIGHTS 


Before we ask you any questions, you must understand your rights. 

You have the right to remain silent. | ; e 

Anything you say can be used "C youin court. On S Oed re UN ñ п 
You have the right to talk to a lawyer for advice before we ask you any questions. | 

You have the right to have a lawyer with you during questioning. 


If you cannot afford a lawyer, one will be appointed for you before any questioning if you wish. 


If you decide to answer questions now without a lawyer present, you have the right to stop 
answering at any time. 


WAIVER OF RIGHTS 


I have read this statement of iny bii and I еза what my rights are. At this time, I am 


Witness: 


Time: 


9 «дум. 
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Universal Case File Number __ |C D- NH- YY / 


Field Office Acquiring Evidence _ Neso Ном en " 
Serial # of Originating Document | BRE 
| 
= M (Address of Contributor) 
а] k. ET 
By 
` : ; (Матео Special Agent) 
To Be Returned 0 Yes Wf No. 
Receipt Given ІП Yes Мо 
Grafid Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rulés of Criminal Procedure E 
Ll Yes № No | Я 
° Title; : к 
C YU$ | | T 


Reference: NE 
(Communication Enclosing Material) 


iginal notes re interview of 


Oct 25 05 O1:3i1p 2038478901 . _ p.i 


J2 Licensing LLC — 


y 
ү 


Special Agent 
Fox: 203-382-6403 рае: October 25, 2005 _ 
Phone: Poges: ] за тс | 
Re: Telephone #’s & Carier — Email j2licensingusa.com _ ыт. 
се] | 
Comments: 


Dear Special Aged | 


Per our meeting my phone numbers in fall of 2002 were The same as no 
The carier/provider is different, then it was CTC Communications 


360 Second Avenue Waliham MA 02451 www.cicnet.com 800-286-7999 was the last l 

contact info | had on them. | do not remember exactly but | i ER В 
me топ] м East Norwalk regarding the subject discussed. | thee 
vaguely recall this from caller ID. n 

F 

5 

i 

; 
3 

ы 

ii 
THE INFORMATION CONTAINED IN THIS ELECTRONIC MESSAGE AND ANY ATTACHED DOCUMENT(S) IS INTENDED ONLY FOR THE PERSONAL AND CONFIDENTIAL USE Я і | 
OF THE DESIGNATED RECIPIENTS NAMED ABOVE. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED АМО j % 
ЖЕ 


CCNRDENTIAL. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPENT, YOU ARE HEREBY NOTIFIED THAT YOU HAVE RECEIVED THIS DOCUMENT IN ERROR. 
AND THAT ANY REVIEW, DISSEMINATION, DISTRIBUTION OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS COMMUNICATION IN 
ERROR, PLEASE NOTIFY US IMMEDIATELY BY TELEPHONE OR BY ELECTRONIC MAIL IMMEDIATELY. THANK YOU. 


05 08:33a 


2038478901 


J2 Licensing LLC 


Fox: 203-382-6603 Date. October 25, 2005 


sel _ тентек а. 


Re: — Prescribed Drugs & Travel Itinerary Email a [ _ Үрісепзпоиво. com 


- Comments: 


E Dear Agen | 


Per our meeting Friday please fi nd on pages two and three of this fax the prescribed 
drugs that l am currently taking. " 


| will also fax you today the phone company and the telephone numbers | had on 
that other issue іп:20021 believe. 


| Pages four through seven are my travel plans for next week consisting of the show 


itself, airline reservations and hotel: 


| If you have nay questions please advise. 


= 


THE INFORMATION CONTAINED IN THIS ELECTRONIC MESSAGE AND ANY ATTACHED DOCUMENT(S] 15 INTENDED ONLY FOR THE PERSONAL AND CONRDENTIAL USE 
OF THE DESIGNATED RECIPIENTS NAMED ABOVE. THIS MESSAGE MAY BE AN ATTORNEY-CLIENT COMMUNICATION, AND AS SUCH IS PRIVILEGED AND 
CONFIDENTIAL, IF THE READER OF THIS MESSAGEIS NOT THE INTENDED RECIPENT, YOU ARE HEREBY NOTIFIED THAT YOU HAVE RECEIVED THIS DOCUMENT IN ERROR, 
AND THAT ANY REVIEW, DISSEMINATION, DISTRIBUTION OR COPYING OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS COMMUNICATION IN 
ERROR, PLEASE NOTIFY US IMMEDIATELY BY TELEPHONE OR BY ELECTRONIC MAIL IMMEDIATELY. THANK YOU, 
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2005 SEMA SHOW 
November 1 through 4 
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eservations - Book Flight - View Itinerary Page 1 of 2 


AmericanAirlines CLOSE WINDOW 


Note: This is not your receipt, which is needed for identification purposes at airport check-in. You will receive 
an itinerary confirmation with your receipt soon. 


с Details 


А Record Locator | Status | Reservation Name 
FSPHXW Í Purchased - i وک‎ 
‚ Your record locator is your reservation | 10/12/2005 09:20 | You can name your reservation so it's 
confirmation number and will be needed to : PM CDT ; easier to locate when you return to AA.com 
: retrieve or reference your reservation. | } (e.g. Quarterly Meeting). 


И 


- AIRLINES — | i } | 
OE Р мик атак кесек he О КАМИЕ 


Award Summary 


Your Itinerary 
Carrier | Flight i Departing I Arriving ` | Cabin Seats 
1 Number : | ERU Жи ЖЕ n E P: : 
i | City i Date & Time ; City ` Date & Time Booking 
} i ; Code 
—— ым ЗИ c алы ыа HUI oot utapana атауын 
зд | 947 | LGA New j 10/31/2005 ! ORD * 10/31/2005 : Fist 2 #5E 
AMERICAN | i York | 06:30 РМ | Chicago 07:17 PM — Е 
AIRLINES 1 К { ! t : 
maen E SED E E TEED — qu میک‎ eisai Тотон аана а mune ж. 
; ал | 1105 : ORD { 10/31/2005 i LAS Las 10/31/2005 i First #5E 
AMERICAN | U : Chicago : 08:46 PM | Vegas ; ; 10:32 РМ | PC 
AIRLINES ; d | 1 E 
Senseo reet tait nare 5 ME SQUE MIRI қата ыса leere eritis ors ТЕОРИИ 
3A t 1806 : LAS Las ‚ 11/03/2005 j ORD š 11/04/2005 : First #5E 
Б i Й i 44: * Chi š 
AMERICAN } : Vegas j 11:40 PM E Chicago i : 04:58 AM pue 
AIRLINES | | : i j 
мам. ی‎ COMMERCE DERE MUN Weeds ait eene "—— — diri cp qe M DRM EOM 
CA і 398 : ORD : 11/04/2005 ; LGA New { 11/04/2005 i First ‚ #5Е 
AMERICAN i i Chicago ! 06:00 АМ York Í 08:58 AM I PL : 
: 1 


Your Price 
И cM EE MTM MEME DE CC M RE EE 
Number of i Miles Total Miles ` А 
š Taxes апа Fees i Price 
Fasson ers er Ticket 3 per Type 
с ges. |; В ket per Type. > cM T Hen REED 
E Passenger(s) ; 90000 i 90000 : L 10.00 USD i 10.00 USD 
: 1 ; * 80.00 USD 
i B ; Award Fee(s) First Passenger 50.00 USD 
م‎ —E азабы ылыс кы ы NE 
Total Miles Used: i 30000 : Total Price . С 00 USD 


Summary Detail 


Credit Card Information 


Pre pe mrt 


Card Type: Í. TERCARD 
Account #: 
Expiration Date: : February 07 

. Description: 1 


E 


nitps://www.ad.com/apps/reservations/Print ViewttineraryandFareSumm... 10/12/2005 


Cot 25 05 08:35a 2038478901 p. B 


Automotive Aftermarket Industry Week Attendee Registration Page 1 of 1 


Ee 
о 


ҚАР S Automotive Aftermarket Industr 
Registration Confirmatior 
November 1-4, 2005 
Las Vegas, NV 


PM РРА 
US ЫЕ ЫЛЫЫ ЕРТ ЫЧ 


| This is NOT a CONFIRMATION 


PLEASE PRINT THIS PAGE FOR YOUR RECORDS 
Monday, October 03, 2005 12:46:00 PM 
J2 Licesing LLC 


405 Silver Creek Lane 
Norwalk, CT 06850 


Your AAIW 2005 registration has been submitted. We invite you to check on the status of your registration by ` 
| AAIW 2005 Registration Look-up page. Visit www.aaiwshow.com and click on the Check Registration Status bu 


' You Registered: Í 
When will I get my badge? 
Approved registrants credentials will be mailed beginning in September. For registration received after October 


will be held for pick-up at "Will Cali" at either the Sands Expo Center or the Las Vegas Convention Center. You 
present both photo and business identification to pick up your credentials. 


л ہو کے‎ E D oo т, 
aE - 
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What if there is a problem processing my registration? 
i In the event that there is a problem, you will be notified by telephone or fax. If you do not receive a confirmat 
; two weeks after registering, please contact Customer Service at aiw051.attendee@expoexchange.com. 


ee 
T 


41 Thank you for registering electronically for AATW 2005 


Back to www.AAIWShow.com 
wwwAAPEXShow.com 
www.SEMAShow.com 


AAPEX Show Management SEMA Show Management 
Phone: 708/226-1300 Phone: 702/450-7662 ext, 118 
Email: info@aapexshow.com | Emall: SEMA-Req@ConvExx.com 


For questions regarding your registration, please call our Customer Service Department at 301/694-5243 between the hours of 9:00 am 
EST or dick here. 


If you have technical difficulties with this web site, please. click here. 


iae At cer rs ачды Uer aot py „эу — cea ee ус oh ot 
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nitps://ww4.expocard.com/aiw051/confirrn.asp 10/3/2005 


"2% 85 08 08:35а —— 2038478901 ` р." 
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ACKNOWLEDGEMENT. 


THIS IS NOT A CONFIRMATION 


Acknowledgment Date: 040CT2005 
Acknowledgment Number: 
Confirmation Number : 


J2 — 
Reservation For: 


56 
b7C 


Convention: 


AAIW 2005 


Hotel Information: 


Arrival Date: 310CT2005 Departure Date: O3NOV2005 # Nights: 03 
Hotel; Riviera Room Type: SINGLE it Hooms: 001 
Sub-Block: Main 


<2%о/ Las ес Blvd 
Aas Vegas 2 МИ £9^9 


7: од 92% <7/0 
F: Foa. PF ИС 
ге. 3) CESS 


АН changes and cancellations must be processed 
through our reservations center at 888-B92-5822. 


b6 
b7C 
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File Number . "126 D— WÄ -92 77 | | 


Field Office Acquiring Evidence. м Hevi 


Serial # of Originating Document 


Date Received 


From 
(Name of Contributor/Interviewee) 
(Address) 
(City and State) 
By 
ToBeRetumed [] Yes | ET No 
Receipt Given ГІ Yes ^ ET No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
L] Yes ET No 
Federal Taxpayer Information (FTT) 
L] Yes LA No 
Title: 
سسا‎ = Ct cT po 
Reference: FD- 3l DT f/o 


(Communicdtion Enclosing Material) 


Description: Ll] Original notes re interview of 


FD-597 (Rev 8-11-94) Page { of 1 


UNITED STATES DEPARTMENT OF JUSTICE Bé 
FEDERAL BUREAU OF INVESTIGATION BIC 
Receipt for Property Received/Returned/Released/Seized 


File # 19 D -4H-— «2471 


On (date) Merch п 2005 item(s) listed below were: 
Г] Received From 
pq Returned To 


[] Released To 
[] Seized 


(Name) 
(Street Address) 


(City) ecu Ik CT OFS О 


b3 FGJ 


Description of tem Д 


Received By: Received From: m 
` (Signature) ) 


r 


14/08/04 ICMIPRO1 


14:47:50 FD-192 Page 1 
Title and Character of Case: 
b5 
bic 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
СЕСЕ ЕС 


DALLAS ТХ 
Anticipated Disposition: pr oe gj Case Agent: U 
Description of Property: Date Entered 
1B 11 
b3 FGI 
Barcode: E03670230 Location: ЕССІ ROW11 Sil 10/08/2004 


Case Number: 196D-NH-42441 - 
Owning Office: NEW HAVEN 


FD-192 (Rev.8-04-02) 
"v 


` | FBI EVIDENCE DATA-LOADING FORM 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of 
evidence. 


Type of Evidence being submitted: Warning - special handling 

ГІ General Evidence ГІ Firearms L] Body Fluids L Other 
C] Valuable Evidence ËQ FGJ lI Whole Blood 

ГІ Drug Evidence ГІ HAZMAT 


ГІ CART Г] Refrigeratio 


Case ID: Title and Characte : 
аерма | | == 


Бел Conse 7: 


Person Acquiring Evidence: Date Acquired: 


b6 


b7C 


Source from which evidence acquired: 


М 


Ross ACO AAC C nity 


] 

/ Price „еш hoc 5 LC Cooperi 
Јо в 

HAS TX 2T>2e/ 


Anticipated Disposition: Federal Taxpayer Information: 


П Yes И No 


Sealed By: [printed name] 
Estimated Dollar Value: 


Complete Description: 


This form is to be used as a data-loading form only. ECT is to discard this form when the information contained herein has been entered 


into Evidence Data Base. 


`w 
Р Chain of Custody FD-192 
* 
b6 
Case ID . : ' Barcode . : bue 


Accepted By: 
Printed Name 


Accepted By: 
Printed Nam vox eme Signatures 


аа d Десе ReneS ane БО ecard W endi. gre qut Date/Time :/ @ 


Accepted By: 
Printed Name:} | | | | |  [........ Signature; = C | |[....... 


Reason:......... SLOPE A .................... Date/Time: 374705". 530.0... .. 
Accepted By: : 

Printed Name:.| | | ә []......... signatures. |__|. 

Reason: . . Trop T.. CR. СӨГІС... Date/Time: . D/9. DIAA... 
Accepted By: | 

E re or) | C$ $C ОН 

Reason: fang TENÎ . CFA, B8 ета ӨМ! ЖЕЛЕ Баке/т1тше:..22г.°%о.......... 
Accepted By: 

Printed мше. j] A Signature: l.a... | 

Reason: . hA Ити) та CAMP... Date/Time:...2722,.7 4 $........ 
Accepted By: 

Printed Мање atts fev dae кеки з X E RS сааат а Fe Sess 

REASONS nd ы d ез ыи? PIDE ЕЛЕК КЕСЕГЕ Date/Time:.................... 


FedEx 
Tracking 
Number 


Fed. US Airbill 


Express 
1 From resse print and press herd. 
EP Sender's FedEx | | 
Dat ۹ “42-057 Account Number 


Senders 
Name 


Compan 


Address 1000 LAFAYETTE BLVD STE 306 


Dept/Foor/Suite/Room 
o, BRIDGEPORT State СТ zp 04604 
2 Your Internal Billing Reference HOV ALAS 
First 24 characters will appear on invoice. 


3 To 


Recipient's 
Name 


Company i ripa teick + Бос се t 


Recipient's 

Address 

We cannot deli т “к= m Dept/Roor/Sute/Room 
Address 

To request a ра 

Ci 1 “е” А State PÁ 1522 2. 


-9 512 


[ yae 


By using this Airbill you agree to the service conditions on the back of this Airbill 
and in our current Service Guide, including terms that limit our liability. 


Questions? Visit our Web site at fedex.com 
or call 1.800.GoFedEx 1.800.463.3339. 


8533 3872 0325 


0314511409 


SPH12 
0215 


Fors 
ID Кә, 


Беер Сову 


ña Express Package Service Packages up to 150165. @ | 
* To most locations 


Гут [Лиин Г) faerie Omg 


ni 55 
dekvery to select locations" 


М] FedEx2Day Ш Fed FedEx Express Saver 
Second business day” 
Ке шы ia шыш бор sind — 
4b Express Freight Service Packages over 150 lbs. 
** To most locations 

О ванае Сенна Г ie 

* Cali for Confirmaton. 

5 Packaging * Declared value [mit $500 
FedEx [LÎ FedEx Pak* О Fedex — []Fedk "| ther 
Envelope* Fedex largo Pak andFedcSunyPak ВОХ Tbe рб 

= = b7C ~ 

6 Special Handling Include FedEx address In Section 3, -------- 
SATURDAY Delivery HOLD Weekday HOLD Saturday 

П Available ONLY for at FedEx Location П at FedEx Location 

Foam paor Я ту IM ar d NOT Ауайа а for fveilalle Qr for 
Freightto select ZIP codes Fedex First Ovarmigit else tata НЫЙ 
Does this shipment contain dangerous goods? 
poem One box must be checked. Sai 
ce 
N No О Де іші г [rs] YES. Destin П КАЖ, х kg 


Shipper's Declaration notrequired 
Dangerous goods (including Dry Ice) cannot be shipped In FedEx packaging. 


7 Payment Bill: pies Acct No. or Credit Card No below. === 
LI Sender Ll Recipient П Third Party Û Credit Card LI Cash/Check 
a се 


[] Cargo Aircraft Only 


FedExAcct М 
Creda Card ito, Бе 
Total Packages Total Weight Total Declared Valuet 
5 00 
Our liabifty is limited to $100 unless you declare a higher value, See back for details, FedEx Uso Only 


8 Sign to Authorize Delivery Without a Signature 


By signing you authorize us to deliver this shipment without obtaining a signature 
and agree to indemnify and hold us harmless from any resulting claims. 


Hbb 


SRSe Rev, Date 11/03 ePart #158279 «(01994-2003 FedEx ePRINTED INU SA. 


үн 


Кы = 
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s 


A ӘУ АЗУ А.Н OL.ONIXEJIV 3480438.Ad402.S UL L.NUId 139-C NV лаал —— 
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Terms Апа Conditions 


"n 


Definitions On this Airbill, “we,” "our," and "us" referto 
Federal Express Corporation, its employees, and agents. "You" 
and "your" refer to the sender, its employees, and agents. 


Agreement To Terms Ву giving us your package to deliver, 
you agree to all the terms on this Airbill and in our current 
Service Guide, which is available on request. You also agree 
to those terms on behalf of any third party with an interest in 
the package. If there is a conflict between the Service Guide 
and this Airbill, the Service Guide will control. No one is 
authorized to change the terms of our Agreement. 
Responsibility For Packaging And Completing Airbill 
You are responsible for adequately packaging your goods and 
properly filling out this Airbill. If you omit the number of 
packages and/or weight per package, our billing will be based 
on our best estimate of the number of packages we received 
and/or an estimated "defauit" weight per package as 
determined by us. 


Responsibility For Payment Even if you give us different 
payment instructions, you will always be primarily responsible for 
all delivery costs, as well as any cost we incur in either returning 
your package to you or warehousing it pending disposition. 


Limitations On биг Liability And Liabilities 
Not Assumed 


* Dur liability in connection with this shipment is limited to the 
lesser of your actual damages or $100, unless you declare a 
higher value, pay an additional charge, and document your 
actual loss in a timely manner. You may pay an additional 
charge for each additional $100 of declared value. The 
declared value does not constitute, nor do we provide, cargo 
liability insurance. 


* [n any event, we will not be liable for any damage, whether 
direct, incidental, special, or consequential, in excess of the 
declared value of a shipment, whether or not Federal Express 
had knowledge that such damages might be incurred, 
including but not limited to loss of income or profits. 


* We won't be liable: 


~ for your acts or omissions, including but not limited to 
improper or insufficient packing, securing, marking, or 
addressing, or those of the recipient or anyone else with 
an interest in the package. 


— if you or the recipient violates any of the terms of 
our Agreement. 


— for loss of or damage to shipments of prohibited items. 


— for loss, damage, or delay caused by events we cannot 
control, including but not limited to acts of God, perils of 
the air, weather conditions, acts of public enemies, war, 
strikes, civil commotions, or acts of public authorities 
with actual or apparent authority. 


Declared Value Limits 


* The highest declared value allowed for a FedEx Envelope or 
FedEx Pak shipment is $500. 


* For other shipments, the highest declared value allowed is 
$50,000 unless your package contains items of extraordinary 
value, in which case the highest declared value allowed 
is $500. 


* Items of extraordinary value include shipments containing 
such items as artwork, jewelry, furs, precious metals, nego- 
tiable instruments, and other items listed in our Service Guide. 


* You may send more than one package on this Airbill and fill 
in the total declared value for all packages, not to exceed 
the $100, $500, or $50,000 per package limit described above. 
(Example: 5 packages can have a total declared value of up 
to $250,000.) In that case, our liability is limited to the actual 
value of the package(s) lost or damaged, but may not exceed 
the maximum allowable declared value(s) or the total declared 
value, whichever is less. You are responsible for proving the 
actual loss or damage. 

Filing A-Claim -YOU MUST MAKE ALL CLAIMS IN 


WRITING and notify us of your claim within strict time limits 
set outin the current Service Guide. 


4 


You may call our Customer Service department at ` 
1.800,GoFedEx 1.800.463.3339 to report a claim; howevey, you 
must still file a timely written claim. 


Within 45 days after you notify us of your claim, you must 
send us all the information you have about it. We aren't 
obligated to act on any claim until you have paid all 
transportation charges, and you may not deductthe amount of 
your claim from those charges. 


If the recipient accepts your package without noting any 


· damage on the delivery record, we will assume the package 


was delivered in good condition. For us to process your claim, 
you must make the original shipping cartons and packing 
available for inspection. 


Right To Inspect We may, at our option, open and inspect 
your packages before or after you give them to us to deliver. 


Right Of Rejection Wae reserve the right to rejecta 
shipment when such shipment would be likely to cause delay 
or damage to other shipments, equipment, or personnel; or if 
the shipment is prohibited by law; or if the shipment would 
violate any terms of our Airbill or our current Service Guide. 


C.0.D. Services С.0.. SERVICE IS NOT AVAILABLE WITH 
THIS AIRBILL. If C.0.D. Service is required, please use a 
Federal Express С.0.р. Airbill. 


Air Transportation Tax Included А federal excise 
tax when required by the Internal Revenue Code on the air 
transportation portion of this service, if any, is paid by us. 


Money-Back Guarantee In the event of untimely delivery, 
Federal Express will, at your request and with some limitations, 
refund or credit all transportation charges. See current Service 
Guide for more information. 


Part #153272 * Rev 1103 


FedEx | Track 


Page 1 of 1 


United States Home Information Center | Customer Support 


Search 


Те е ES ee Ue Office z Print Services | FrelghtServices | Expedited Services 
| Ship | Так | Manage Му Account | International Tools | 


Track Shipments | Printable Version (%) Quick Help 
Detailed Results | 


526 
Wrong Address? 
Tracking number Destination PITTSBURGH, PÀ Reduce future mistakes by usin 
Signed for by Service type FedEx 2Day Service FedEx Address Checker. 
Ship date Sep 22, 2005 
Delivery date Sep 26, 2005 10:26 AM Shipping Freight? 
А FedEx has LIL, air freight, 
Status Delivered Я surface апа air expedited freight 
BUY ш multi piece package deliveries, 

Mah ut УСТУ . and ocean freight. 

Date/Time Activity Location: > ME . Details 
ea е лала. „улыл — 

Ѕер 26, 2005 10:26 АМ Delivered ~ PITTSBURGH, A 


Need to track a 
FedEx SmartPost 


| Signature proof" | rack тоге shipments ` | | PEE 
i shipment? 


Email your detailed tracking results (optional) 


2 


Enter your email, submit up to three email addresses (ЕВА Ка by. commas); add your 
message (optional), and click Send email. т eme 


Add a message to this email. 


From Ns o F : 


*U.S. GPO: 2004-305-792/81146 
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UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION bé 
Receipt for Property Received/Returned/Released/Seized BIC 


File# уор MH Bs | 


On (date) 9.-22-2005- item(s) listed below were: 
Received From 
ьа Returned To 
[] Released To 
DJ Seized. 


(Name) | | / A ceu atr AT + be ke her T i 


(Street Address) S 2 SC Sm аай sto _ 


(City) Нет PA 152.2 2 


Description of temo: | ° | esa  “ 
— | Lex pee es Ahas! 


09/28/04 ICMIPR01 
08:10:41 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


b6 
ыла сы Аз ы > د‎ — Ша. 2 ا‎ > -—— ee 
Date Property Acquired: Source from which Property Acquired: 
pu ك‎ 
DALLAS TX 75201 
Anticipated Disposition: Acquired By: Case Agent: 
Description of Property: Date Entered 
1B 10 
ЪЗ FGJ 
Barcode: E03670095 Location: .- | 09/28/2004 
E03670095 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


PACKAGE COPY 


Su “Wp XS S. fe OR =s um TT ЕЕЕ = gu ee ЫГА 


FD-192 (Rev. 3-04-02) 


FBIEVIDENCE DATA-LOADING FORM 


Separate forms are mandatory for evidence seized on different dates, at different locations, by different individuals, for different types of 
evidence. 


Type of Evidence being submitted: Warning - special handling 


LJ General Evidence ГІ Firearms L] Body Fluids Г] Other 
Г] Valuable Evidence А е [Г] Whole Blood 
ГІ Drug Evidence ГІ HAZMAT 


П CART 


Case ID: 
I4, D-^ A - ЧА «У 1 


Person Acquiring Evidence: 


Source from which evidence acquired: 


> 


Ross AC ACC AIT 
5 /Ғ0%4 
HAS TX Doles 


ederal Taxpayer Information: 
L] Yes И] No 


Anticipated Disposition: 


Sealed By: [printed name] 


Estimated Dollar Value: 


b3 FGJ 


Bek po ae ee mA ee Т 
This form is to be used as a data-loading form only. ECT is to discard this form when the information contained herein has been entered 
into Evidence Data Base. 


Chain of Custody FD-192 


Case ТР. : EO аи ВО ааа... E 
Accepted By: bó 
Printed Name:..... . Signature:... DIC 
Reason:..Collected....... FET.. E kuy амы ere Date/Time: = .3⁄£ ر ر‎ Cyan, 
Accepted By: ‚ 
Printed Name:........................... ораев на fan дынын ote a O 
REASONS: 6 red es UE RAUM в SERGE dete ты te BE Date/Time:.................... 


Accepted By: ; 
Printed Мате azu к Va hum aca We hae ew Signatures seu ieee su s к RR ee 


WEAPONS CHECKED & CLEARED BY FIREARMS INSTRUCTOR 


Signature:..... cece eee eee nnn Dateien sk d 


( ( 
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File Number b6 
b7C 

Field Office Acquiring Evidence Í Views Hay eu : 

Serial # of Originating Document 2 ) Ч | 


Date Received 


From 


Norval е CT 


(City and State) 


» sel C | 


То BeRetumed [Л ves x No 


Receipt Given O ves g No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules-of Criminal Procedure 


П Yes V No 
Federal Taxpayer Information (FTI) 
О Yes E No 


Title: 


Wh) 


Reference: 
(Communication Enclosing Material) 


Description: B. Original notes re interview of 


ok I е „э AMEX 
EE delivery " | "ul 


FD-340 (Rev. 4-11-03) 


File Number ` i 961 y AH - ouem 


Field Office Acquiring Evidence 


Serial # of Originating Document 


Name 44 ontrihuta 


(City and State) 
» sA) | 
То BeRetumed Г] Yes No 
Receipt Given П ves No 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


Ll ves 51 No 
Federal Taxpayer Information (FTI) 

П ves š No 
Title; 
Reference: 


(Communication Enclosing Material) 


Description: B Original notes re interview of 


: Le wy deposit 
Deposit — Жж Jeller Pers й pete 
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Lewiston, ME 
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| File Number 9 = “0 Ya 


г2- 
Field Office Aéquiring Evidence cs 


Serial # of Originating Document ... 


jae Reed ИИ ВАБ ЕТ ТКТ кн | 


f M EN —  áÁ— 
! ame of Contributor/Interviewee) А 


(Address) 
Soe Ciy and Stat) — щщ T] 
To Be Returned Ll] Yes [No ; 
Receipt Given ГІ Yes ^ ET No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) : | s 


Federal Rules of Criminal Procedure 


[1 Yes 27% 


Federal Taxpayer Information (ЕТІ) 


О Yes Бю No 


Reference: I 
(Communication Enclosing Material) 


Description: Xl. Original notes re interview of 
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03/31/03 @ % ІСМІРКО1 


14:25:30 | FD-192 : Page 1 
Title and Character of Case: 
BELL CONSULTING 
INR C a ا‎ r з A === >, T 
Date Property Acquired: Source from which Property Acquired: 
03/21/2003 b7C 
| PITTSBURGH РА 
Anticipated Disposition: Acquired Ву: Case Agent: 
p] [ — —1 
Description of Property: Date Entered 
iB 1 
b3 FGI 
Barcode: E02119146 Location: 03/31/2003 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN SAM 


b6 
b7C 


FILE COPY 
Жао NH UD dd С | 


03/31/03 @ б ICMIPR01 


14:29:34 FD-192 Page 1 
Title and Character of Case: 
b6 
b7C 


BELL CONSULTING 


и 
Date Property Acquired: Source from which Property Acquired: 


03/21/2003 
STAMFORD CT 


a 
Anticipated Disposition: Acquires зу: Case m 


Description of Property: Date Entered 


iB 2 
b3 FGI 
Barcode: E02119147 Location: 03/31/2003 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
Case Number: 196D-NH-42441 56 
Owning Office: NEW HAVEN ule 
0 


FILE COPY 
(dab - МНА? 1 4 1-(6 > 


03/31/03 @ @ ICMIPR01 


14:33:23 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


Cc со у. асасы зар: و ي ا ت‎ э т=з ш о аш = ыссы E 
Date Property Acquired: Source fy 1 j : 
ATTORNEY 


03/21/2003 b6 
STANFORD CT b7 
ыыы СА 7 ала ا‎ u o ЕЕЕ ا ا‎ Ж Ала کے و و ی‎ LEER AOI Verr эб ШЫ 
Anticipated Disposition: — = oo oy 
Description of Property: Date Entered 
1B 3 
b3 FGI 
Barcode: E02119148 Location: 03/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN ABA 


FILE COPY b7C 
“в b UJ - e UU(-(B 3 


03/31/03 
14:34:57 


per om 
@ ICMIPR01 


FD-192 Page 1 


Title and Character оЁ Case: 


BELL CONSULTING 
Date Property Acquired: 


03/21/2003 


Anticipated Disposition: a сҮ: 


Description of Property: 
1B 4 


Barcode: E02119149 


Source from which Property Acquired: | 
ATTORNEY | be 


PITTSBURGH PA 


Location: 


b7C 


Case — 


Date Entered 


ЪЗ FGJ 


03/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 


Owning Office: NEW 


HAVEN 


FILE COPY 
Janah- 22 44/84 


08/27/03 7 ІСМІРЕ01 
11:54:32 FD-192 Page 1 
Title and Character of Case: 
BELL CONSULTING 
Date Property Acquired: Source from which Property Acquired: 
° 
08/15/2003 ртс 
Anticipated Disposition: Acquired By: Case Agent: 
کڪ‎ [ |] 
Description of Property: Date Entered 
iB 5 
b3 FGJ 
Barcode: E02119617 Location: ЕССІ 08/27/2003 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
b6 
23 b7C 


FILE COPY ~ 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


Gutt- YOU IBS 


Ф 
Ф 


08/27/03 ICMIPROL  . 
11:57:14 FD-192 Page 1 | 
Title and Character of Case: 
Date Property Acquired: Source from which Property Acquired: 
Атто — — —  — ] 5 
08/15/2003 b7C 
Anticipated Disposition: === Е Case — 
Description of Property: Date Entered 
iB 6 
b3 FGJ 
Barcode: Е02119618 Location: 08/27/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


FILE COPY 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


1- daydi- ZU 


100 


@ é 


04/23/04 ІСМІРЕ01 
10:29:50 FD-192 Page 1 


Title and Character of Case: 


b6 
b7C 
BELL CONSULTING 
| Date Property Acquired: Source from which Property Acquired: 
| FORENSIC EXAM 
04/20/2004 
——————MÉ-————— و کے ا ج‎ n 
Anticipated Disposition: emn iain | —; 
Description of Property: Date Entered 
1B 7 i 
PF s a 
Barcode: E02120519 Location: ECC1 ROWA S15 04/23/2004 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


IIED- pt RULL — 497 


04/23/04 ICMIPRO1 
10:35:38 FD-192 Page 1 


Title and Character of Case: 


— 


Date Property Acquired: Source from which Property Acquired: 


FORENSIC EXAM bé 
04/22/2004 bic 
—-— penc و‎ те с Z= ED د‎ Те == дшш сыешлы иы 
Anticipated Disposition: Acquired Бу: айй 
Description of Property: Date Entered 
iB 8 
b3 FGJ 
Barcode: E02120518 Location: ЕССІ ROW4 S15 04/23/2004 
Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 
g A408 


o. COPY 


/2éD-Jte- tadi- L8 


09/03/04 ICMIPR01 
08:50:35 FD-192 Page 1 
Title and Character of Case: 
BELL CONSULTING 
Date Property Acquired: ш whi Property Acquired: 
08/23/2004 WE 
PITTSBURG PA к 
Anticipated Disposition: peu] Case = 
Description of Property: | Date Entered 
iB 9 
b3 FGJ 
Barcode: E02120996 Location: 09/03/2004 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
Case Number:  196D-NH-42441 - |66 | 
Owning Office: NEW HAVEN А 
e b7C 


FILE COPY Ж 


09/28/04 j @ ICMIPRO1 
08:10:41 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
sms С 


DALLAS TX 75201 


بن = 


У] Gy 
С) 


Amticipated Disposition: Acquired By: : 
[ [ 
Description of Property: Date Entered 
1B 10 
b3 FGJ 
Barcode: E03670095 Location: 09/28/2004 


Case Number:  196D-NH-42441 ~ 18(0 
Owning Office: NEW HAVEN Rw 


FILE COPY ASS 


16-10 


10/08/04 @ ICMIPR01 
11:47:50 FD-192 page 1 


Title and Character of Case: 


С 


BELL CONSULTING 


_— © ————— 
Date Property Acquired: urce from which Property Acquired: 
b6 
09/08/2004 элс 


DALLAS TX 
a a a a aaa auam 
Anticipated Disposition: Acquired Ву: NEN 
Description of Property: Date Entered 

1B 11 
b3 FGJ 
Barcode: E03670230 Location: ЕСС1 ROW11 S11 10/08/2004 
47 
b6 
bic 


FILE Copy 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


| 5-11 


10/14/04 H ICMIPR01 
10:21:11 FD-192 Page 1 


Title and Character of Case: 


Wu 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


[ _ [ i 


10/06/2004 
Anticipated Disposition: Acquired By: Case Agent: 
Description of Property: Date Entered 
1B 12 
b3 
b6 
Barcode: E03670235 Location: 10/14/2004 b7C 


FILE COPY 


Case Number:  196D-NH-42441 


Owning Office: NEW HAVEN 


10/25/04 9 é ІСМІРК01 


15:01:03 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


WWE b6 
10/21/2004 b7C 
Anticipated Disposition: pem — um ана 
Description of Property: Date Entered 
1B 13 
b3 FGJ 
Barcode: E03670293 Location: ECC1 ROW2 S27 10/25/2004 


FILE COPY. 


Case Number:  196D-NH-42441 — ( 
Owning Office: NEW HAVEN 


09/13/06 ICMIPR01 
15:00:02 ` FD-192 ' Page 1 
Title and Character of Case: 
BELL CONSULTING 
Date Property Acquired: Source from which Property Acquired: 
. b6 
09/07/2006 b7C 
Anticipated Disposition: Acduired Бу: Case Agents 
Description of Property: Date Entered 
1B 14 
ЪЗ FGI 
Barcode: Location: 09/13/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 ~| BI 
Owning Office: NEW HAVEN Y 


ple orm 


Y | ` 
01/10/07 Ф @ ICMIPRO1 


16:32:30 FD-192 Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which perty Acquired: 
Қ b6 
12/29/2006 1241 EAST MAIN ST b7C 
STAMFORD CT 06902 
Anticipated Disposition: Acquired By: Case Agent: 
[  —] ИШНЕН 
Description of Property: Date Entered 
1B 15 
b3 FGJ 
Barcode: E04020727 Location: 01/10/2007 


Case Number: 318A-NH-42441 
Owning Office: NEW HAVEN 


FILE 205% 


А-А AWU {PIS 


EN | 
© © 
| | (NH) (FBI) 


From: CNH) (FB) 

Sent: , 2007 8:11 AM 

To: (NH) (FBI) 

Subject: 1B evidence 

UNCLASSIFIED b6 
NON-RECORD b7C 


d | b3 FGJ 
i iued the 192 оп 318A-NH-42444, serial 1В15. | noted one minor mistake. The fourth listed — | 
are toy action figures. | was not sure if it mattered or not, but | thought I'd just let you know. 


UNCLASSIFIED 


| э 
03/31/03 9 i ICMIPRO1 


14:40:58 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
| —————— —- P" 


03/05/2003 b7C 
PITTSBURGH PA 
ا‎ ДШМЦМДМДШЫ-  -- 
Anticipated Disposition: —ee at pass Beene 


Description of Property: Date Entered 


1C 1 
b3 FGJ 
Barcode: Location: 03/31/2003 
a 
Case Number: 196D-NH-42441 POR 
Owning Office: NEW HAVEN — 
| — 


FILE COPY 
[as AH >С 


04/30/03 @ @ ICMIPR01 


10:33:02 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
ATTY. 
04/21/2003 


Anticipated Disposition: — = Case — 


Description of Property: Date Entered 
1C 2 
b3 FGJ 
Barcode: Location: 04/30/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 


Owning Office: NEW HAVEN Жаз nc 


(an b"7C 


FILE COPY 
_ Meo HU n | AC 


04/30/03 @ 


10:34:46 


Title and Character of Case: 


BELL CONSULTING 


04/21/2003 


Description of Property: 


ICMIPRO1 
FD-192A Page 1 


Date Property Acquired: Source_from which Property Acquired: | 
ATTY.| | b5 


RC 


Anticipated i EDAM ME Case — 


Date Entered 


1c 3 
b3 FGI 
Barcode: Location: 04/30/2003 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
Case Number:  196D-NH-42441 be 
Owning Office: NEW HAVEN [ Тахм, 


E 
FILE COPY 


А OVE Aas | 1625. 


04/30/03 
10:37:01 


BELL CONSULTING 


Date Property Acquired: 


Title and Character of Case: 


© ICMIPRO1 


FD-192A Page 1 


Source from which Property Acquired: 


b7c 


04/21/2003 
SOUTHPORT CT 
Anticipated Disposition: Acquired By: Case Agent: 
| | С 
Description of Property: Date Entered 
1C 4 
b3 FGJ 
Barcode: Location: 04/30/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 
Owning Office: 


196D-NH-42441 
NEW HAVEN 


FILE COPY EN 
LN 


| M D- AMI ut ( C Z 


@ o 
04/30/03 ' ICMIPROL 


10:45:03 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
ATTY. | 


04/25/2003 b7C 
Anticipated Disposition: Acquired By: Case Agent: 
—— —— —3 е 
Description o£ Property: Date Entered 
1С 5 
Barcode: Location: 04/30/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN AD» 


FILE COPY fe 
Доо ау 


04/30/03 9 ICMIPROL 
10:46:17 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


04/25/2003 b7C 
u ي‎ ss MM uuu ss ШЕ 
Description of Property: Date Entered 

1C 6 
b3 FGJ 
Barcode: Location: 04/30/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


Со 0-NY 2e 


05/07/03 f ICMIPR01 
12:38:38 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired:  Sourc i i ; 
ATTY. b5 


04/30/2003 b7C 
Anticipated Disposition: Acquired By: Case Agent: | quired By: uae А gent 
Description of Property: - Date Entered 

1C 7 
b3 FGJ 
Barcode: Location: 05/07/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


OH OMI AC? 


@ | 
06/13/03 Ф ICMIPR01 | 


09:14:10 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


— "LECT MEER ام‎ NE E E тек кке 
Date Property Acquired:  Sourc i i А 
АТТҮ. b5 


05/14/2003 b7C 
Iz p s MM occ RR MN iia 
Description of Property: Date Entered 
1С 8 
b3 FGJ 
Barcode: Location: 06/13/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 b6 
Owning Office: NEW HAVEN b7C 


FILE COpy 


Кар AH- qot СЕ 


06/20/03 
16:20:11 


FD-192A 


Title and: Character of Case: 


BELL CONSULTING 
Date Property Acquired: 


06/20/2003 


Anticipated Disposition: 


Description of Property: 
1С 9 


Barcode: 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Source f i i i 
ATTORNEY s 


PITTSBURGH РА 


Acquired By: 


Location: 


Case Number:  196D-NH-42441 


Owning Office: NEW 


HAVEN 


FILE COPY 


ө ICMIPR01 


Page 1 


b7C 


Date Entered 


b3 FGJ 


06/20/2003 


He Duft) Gem 


07/31/03 @ Ф ІСМІРКО1 


14:57:04 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


bic 
07/09/2003 


STAMFORD CT 


Anticipated Disposition: — БУ: cd 


Description of Property: Date Entered 
1С 10 
b3 FGI 
Barcode: Location: 07/31/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number: 196D-NH-42441 be 
Owning Office: NEW HAVEN dg b7C 


ax co = 


(Te D- uu- u 2 «4-/C/0 


09/24/03 @ | ICMIPR01 


11:03:36 FD-192A Page 1 


Title and Character of Саве: 


BELL CONSULTING 


Date Property Acquired:  Sourc which Property Acquired: 
ATTY. b6 


09/15/2003 b7C 
PITSSBURGH PA 
Anticipated Disposition: — = Case — ا‎ 
Description of Property: Date Entered 
iC 11 
ЪЗ FGJ 
Barcode: Location: 09/24/2003 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


=== Wumper: ي‎ = 
Жо ус 2. yo 

Дш: 

FILE COpy un 


fa D-H Кәче! -A Cy 


12/04/03 ө © ICMIPR01 


16:18:53 FD-192A Page 1 


Title and Character of Саве: 


BELL CONSULTING 


pee per er л Rue n کک ا ا‎ 232355 ал ора l эы ім сыз саг 
Date Property Acquired: Source f i roperty Acquired: 
ATTORNEY j 


Or or. 


11/25/2003 


Anticipated EDUC Т] mcus 


Description of Property: 


Case — = 


Date Entered 


1C 12 
b3 FGJ 
Barcode: Location: 12/04/2003 
Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 
AMB 


|acD- NH- 2 4uI- |C [2 


FILE COPY “La m 


04/02/04 ! @ i | ICMIPRO1 


11:18:39 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


nmt = ERR ee — = x 
Date Property Acquired: Source from which Property Acquired: 
ATTY | |= 


04/01/2004 Ь7с 
€———— — MR > = À M аны Шш us 
Anticipated Disposition: — БУ: Саве Agent: 

Description of Property: Date Entered 
1С 13 
b3 FGI 
Barcode: Location: 04/02/2004 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN AN b6 


FILE COPY 


04/19/04 @ ' ICMIPRO1 
16:04:03 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


NN ::——————,O M 
Date Property Acquired: —— ron which Property Acquired: 


04/09/2004 
NEN» » ME 
Anticipated Disposition: mmm БҮ: ae en 
Description of Property: Date Entered 

1C 14 

ЪЗ FGJ 
Barcode: Location: 04/19/2004 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 

b6 

bic 


Case Number: 196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 
19-14 


@ ТСМТРКО 


04/19/04 
16:08:55 FD-192A Page 


Title and Character of Case: 


BELL CONSULTING 


04/09/2004 


Description of Property: Date Entered 
iC 15 
b3 FGJ 
Barcode: Location: 04/19/2004 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


i 
1 


RESTE NE RR = ي‎ 21. за ы гы = > рыз == 
Date Property Acquired: Source from which AN — 

Ea a BP = و‎ = Дз == о. уз یو ےو ا ے اھ‎ кыша a RE 
Anticipated up Case X 


| 04/19/04 © @ ICMIPRO1 
| 


16:18:47 FD-192A Page 1 


Title and Character of Case: 


Oq q he l yRm)|, , ., X X X X XE" XE XZ ç X X ç K X X SÁX T w 
Date Property Acquired: 22222 топ шісі wa w 


04/09/2004 
b6 
b7C 
Anticipated Disposition: Acquired ЗУ: Саве Agent: 
Description of Property: Date Entered 
1C 16 
b3 FGI 
Barcode: Location: 04/19/2004 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 
b6 
b7C 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 
\C~ flo 


@ e 
06/01/04 j ай ІСМІРЕ01 
11:20:46 Ер-192А Раде 1 


Title and Character of Case: 


BELL CONSULTING 


PITTSBURG, PA 


04/16/2004 b6 
: b7C 
Anticipated Disposition: Acquired Бу: po 
Description of Property: Date Entered 
ІС 17 
b3 FGI 
Barcode: Location: 06/01/2004 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 -jelt 
Owning Office: NEW HAVEN ADS 


07/30/04 Ф © 


14:28:44 FD-192A 


Title and Character of Case: 


BELL CONSULTING 


оза St i eR Tuc ا‎ эш a == xn ا‎ === ы алаты ШЫ шы = 
Date Property Acquired: Source from which from — 
b6 


07/20/2004 . b7C hs 
PITTSBURG PA 


„с На E ENDS 
MERE сымын ` рын 


ште = > ==‏ ا ыла‏ س س س 
Description of Property: Date Entered‏ 
1C 18 !‏ 


Barcode: Location: 07/30/2004 iz 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) ; 


[4 


Case Number:  196D-NH-42441 - |С1(% 
Owning Office: NEW HAVEN 


FILE COPY 


6 ICMIPROL 


07/30/04 
14:37:00 FD-192A Page d 
Title and Character of Case: i 
b6 
b7c 


BELL CONSULTING 


РОБЕ ———— ا‎ —-.———————————--—————_——————————— леене} 


06/10/2004 ; 
Anticipated Disposition: Acquired By: | Case Agent: 5 s mx s == | 
ннер 

1С 19 7 
b3 FGI 


Barcode: Location: 07/30/2004 <: 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) m 


Case Number:  196D-NH-42441 ~ IC í(3 oo 
Owning Office: NEW HAVEN T x 


FILE COPY 


09/30/04 Ë 9 ICMIPRO1 


15:45:00 FD-192A Page 1 


Title and Character of Case: 


BE NSULTING BIC 


Date Property Acquired: Source from which Property Acquired: 


08/03/2004 


Anticipated Disposition: Acquired Бу: = 


Description of Property: Date Entered 
1С 20 


Barcode: Location: 09/30/2004 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 — (C 2С) 


Owning Office: NEW HAVEN EN A sc 
HECOY Г 


| C-A0 


` 08/31/05 e ICMIPRO1 


22:50:37 | FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source f j y Acquired: 
ATTORNEY b6 
08/29/2005 bic 
^о Ала ТТТ cm 
Anticipated Disposition: — ый Case — 
Description of Property: Date Entered 
1C 22 
Barcode: Location: 08/31/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 


Owning Office: NEW HAVEN b6 
mp 


FILE COPY 


1460 -/'o(*-42«4«4t— )С22. 


11/21/05 


ICMIPRO1 
11:33:28 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
| | b6 
11/15/2005 b7C 


PITTSBURG PA 


Anticipated Disposition: —c a 22228201 


Description of Property: Date Entered 
1C 23 
Loo [ DOE 
Barcode: Location: 11/21/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


[860 -io« - Q2 co 1€ 22 


12/05/05 @ @ ICMIPR01 


11:32:06 | FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


нн Ld 
b6 


11/18/2005 b7C 
Anticipated Disposition: wa 5 Case agenti 
Description of Property: Date Entered 
1С 24 
b3 FGJ 
Barcode: Location: 12/05/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


ap r^t oc 54? E TONNERRE nr 
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Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


|460 -мН- 44441 – 1624 


11:34:27 FD-192A Page 1 


12/05/05 ICMIPR01 


Title and Character of Case: 


pate Property анаа аша ааа ваа YC 
b7C 

11/18/2005 

Anticipated Disposition: m ss NENNEN 


Description of Property: Date Entered 
1C 25 — 
b3 FGJ 
Barcode: Location: 12/05/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


FR 
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niet TO RULE G “eu. P ae 
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Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


GOW YAUM- 1С287 


12/22/05 ІСМІРЕ01 


16:29:25 Ер-192А Раде 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: | Source from which Property Acquired: 
| | b6 


12/15/2005 DIC. 
Anticipated Disposition: Acquired By: Case Agent: © quired B ZEN RN 
Description of Property: © Date Entered ` 

1C 26 
b3 FGI 
Barcode: Location: 12/22/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 


Owning Office: NEW HAVEN » ) we 
кик сору Е-е 


|460-455- CAUCE = (C26 


12/29/05 9 ICMIPRO1 
13:45:44 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 
| | b6 


12/22/2005 b7C 
Anticipated Disposition: UE xm Case aum 
Description of Property: Date Entered 
iC 27 
Barcode: Location: 12/29/2005 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 


Owning Office: NEW HAVEN b6 


DECLASSIFICATION АПТНОВТТҮ DERIVED FROM: 
ЕБІ AUTOMATIC DECLASSIFICATIUM GUIDE @ 


DATE 03-17-2011 » id 
93/20/96 17 ІСМІРЕ01 
08:35:37 D-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: p Property Acquired: 
b6 
03/15/2006 BIE 
d ee rds j proe 
Description of Property: Date Entered 
1C 28 
b3 FGJ 
Barcode: Location: 03/20/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN T 
DIG: 


DECLASSIFICATION АПТНОВТТҮ DERIVED FROM: 
FEI AUTOMATIC DECLASSIFICATION GUIDE 


DATE 03-17-2011 ) e 
03/20/06 ІСМІРКО1 
08:36:14 Раде 1 


Title and Character of Case: 


Date Property Acquired: Source from which Property Acquired: 


bé 
03/14/2006 


Anticipated Disposition: acquired Бу: a 


Description of Property: 


Date Entered 
1С 29 
b3 FGI 
Barcode: Location: 03/20/2006 


Case Number: 196D-NH-42441 ( 
Owning Office: NEW HAVEN 


03/29/06 i ICMIPR01 


08:13:59 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: b6 


LEGAL PROCESSING [|_| |] ье 


03/27/2006 


Anticipated Disposition: — = с = | 


Description of Property: Date Entered | 
1C 30 


b3 FGI 


Barcode: Location: 03/29/2006 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


PILE COPY 


I&60-rote Чаҷи( - (C326 


ә @ 
03/29/06 ICMIPR01 


08:26:46 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: ource from which Property Acquired: 
| | b6 


03/27/2006 БТС 
Description of Property: Date Entered 
1C 31 
b3 FGJ 
Barcode: Location: 03/29/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN pot 


EILE SOPY 


(d GO-vou- UaU- 1C3| 


04/03/06 % @ ICMIPR01 


11:14:21 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


b6 
03/29/2006 b7C 
“Е oe ed 
Description of Property: Date Entered 
1C 32 
рз FGI 
Barcode: Location: 04/03/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


D) JURY ONLY 
AND JURY MATERIAL- DISSEMINATE 
үт TO RULE б), Fed. R. Crim. P. 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


466-404 < AUC = ERL 


04/03/06 @ e ІСМІРК01 


11:15:58 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: puerum Property Acquired: 
b6 


03/28/2006 b7C 


Anticipated Disposition: Acquired By: Case — d 


Description of Property: Date Entered 
1C 33 


‚с 71 n 


Barcode: Location: 04/03/2006 
Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Сд JURY MATERIAL - DISSEMINATE ONLY 
PURSUANT TO RULE бе), Fed. К. Crim. P. 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


ы 
ug сору Ho- 


1460-м: Ч2ЧЧІ ~ 1623 


+ r ü ` 
04/11/06 o . © #CMIPR01 


08:39:45 ` Ер-192А Page 1 
Title and Character of Case: 
BELL CONSULTING 
Date Property Acquired: i rty Acquired: 
b6 
04/10/2006 b7C 


NORTH BERGEN NJ 07047 


Anticipated repente pem m] case w 


Description of Property: Date Entered 


iC 34 
Barcode: Location: 04/11/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 
PILE COPY 


1460-04-4244/-2С3Ч4 


° ' 
04711/06 e ^ ` ICMIPRO1 
08:40:15 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 
Date Property Acquired: I fr which Property Acquired: 


04/10/2006 bC 
NORTH BERGEN NJ 07047 


Anticipated Disposition: Acquired ВУ: Саѕе agent: 


Description of Property: Date Entered 
1C 35 
Barcode: Location: 04/11/2006 


Grand Jury Material (Disseminate only pursuant to Rule 6(e)) 


Case Number:  196D-NH-42441 
Owning Office: NEW HAVEN 


FILE COPY 


1960-wH- 244 € 716237 


04/21/06 ф % ІСМІРЕ01 


11:33:16 FD-192A Page 1 


Title and Character of Case: 


BELL CONSULTING 


Date Property Acquired: Source from which Property Acquired: 


04/20/2006 b7C 
GS SSE IUE Са s= n 
Anticipated Disposition: — = Case Agent: 
Description of Property: | Date Entered 
1C 36 
b3 FGJ 
Barcode: Location: 04/21/2006 


Grand Jury Material (Disseminate only pursuant to Rule айыў? 


Case Number:  196D-NH-42441 NS. 


Owning Office: NEW HAVEN | 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/13/2003 
To: New Haven 


From: New Haven 
BRA-1 


contact: L | 
approved By: [|] 
Drafted By: [— as 


Case ID #: 196D-NH-NEW 


(Pending) 


Title: 
BELL CONSULTING, 


BELL L-«CENSIENG; 
(SSAI); 


WORLD WRESTLING ENTERTAINMENT, . (WWE) - VICTIM; 
FBW; 


Synopsis: Meeting held with attorneys for World Wrestling 
Entertainment Inc. (WWE) who provided information on apparent 
fraud involving above subjects. 


Details: On 03/05/2003, a meeting was held in the office of the 


United States Attorney in Bridgeport, CT which ttended by 
writer, Assistant United States Attorney (AUSA) as 
well as attorneys of Day, Berry and Howard in 
Stamford, CT, telephone nu and 


and[ оғ Е and Lockhart in Pittsburgh, РА, 
ea shone aes hone number During that necting, [ O] 
[ j and provided an overview of a frau ey 


maintained ha een perpetrated against their client, WWE. 


They stated that WWE employee[ ^  ]was the 


and in that capacity, it was one of 
his responsibilities to procure license agreements for the WWE. 
He was strictly a salaried employee and according to an 
employment agreement, he was not eligible for any type of 
commission payment. 


Additionall the WWE entered into an agreement with 
to be the outside licensing agent for the WWE. —€— | 


cénsing 


was not salaried but did receive commissions on lig 


business he brought to the WWE. Shenker however was not entitled 


бк. LWD - 


BRA) 
O 


CPT ala 


| fans | 
QS Ww E Fe у INE LL d ! 
(exe assign p csse 
Ws Ye i 2 Va 
7 
i GoD NÈ 4 


wa | 


S 


~ © 
о 


56 
БТС 


To: New Haven From: New Haven 
Re: 196D-NH-NEW, 03/13/2003 


to commissions on licensing business procured by the WWE on its 
own, independent of SSAI. 


They advised that 1 while a WWE employee, formed 


ny, Bell Consulting, and entered into an agreement 
with (SSAI) whereby directed potential licensees 
which ñad not been develope y to SSAI. It would thus 


appear that SSAI had generated the resulting licensing business 
and they would receive a commission from the WWE. Thus, WWE was 
paying a commission it should not have had to pay. In return for 
directing the business through SSAI, via Bell Consulting, 
received a kickback from SSAI representing half of the commission 
paid to SSAI by WWE. 


They advised ل ا‎ also arranged for 
payment from at least one W icensee in exchange for a generous 
licensing agreement. That payment was also shared A 


They also advised that[____]manufactured phoney 
invoices to account for monies paid to Bell Consulting by SSAI in 
furtherance of the fraud and illegal activity they were 
conducting. 


Losses to WWE in this scheme are well in excess of 
$1,000,000. 


In view of the above, it is recommended that this 
matter be opened and assigned for investigation. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/20/2003 


subpoena directed to the 
formerly known as 
in Norwalk, Connecticut Was Serve 


at facsimile number 
Connecticut.  Attorne 

agreed to accept service on behalf of A copy of 
the subpoena and facsimile journal are attached hereto. 


Investigation on 03/13/2003 a Bridgeport, CT 


File# 196D-NH-42441 -Å : Date dictated 03/20/2003 


by _ SA :gds А 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/20/2003 


b3 FGJ | 


Connecticut was served via facsimile on 


Attorne at facsimile number Attorney 
EN о accept service on behalf A copy of the 


subpoena and facsimile journal are attached hereto. 


Investigation on 03/13/2003 a Bridgeport, CT 


Fie * 196D-NH-42441 -2 ; Date dictated 03/20/2003 


ty SA gds An b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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DATE, TIME 
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DURATION : 
PAGE(S) a3 


RESULT OK 
MODE STANDARD 
ECM 
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FEDERAL BUREAU ОЕ INVESTIGATION 


Date of transcription 03/25/2003 


q Attorney 


onn 1 1 ; ; ; Q 
[| —— aE Facsimile number] | o | бтпеү 


represents and agreed to 
accept service on its behalf. A copy of the subpoena and facsimile 
journal are attached hereto. 


Investigation on 03/19/03 a Bridgeport, CT 


File # 196D-NH-42441 - Date dictated 03/25/03 me 


by SA :gds MNS b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


b3 FGJ 
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| AOS 
| FEDERAL BUREAU OF INVESTIGATION 
Précedence: ROUTINE Date: 03/31/2003 
To: New Haven Attn: ect[ | 
From: New Haven on 


BRA-1 


contact: [ — — — — — — — — — —] 
9 


Case ID #: 196D-NH-42441° ~ (Pending) 
Titles [ара 


BELL CONSULTING, 
BELL LICENSING; 


pS sca 
: ENTERTAINMENT, INC. (WWE) - VICTIM; 


Synopsis: Late submission of evidence. 


b6 
Details: Submission of records provided by Attorneys b7c 


on 03/05/2003, including itled "SSAI 
WE, Trinity соо 27201 
шш Consulting, LL ransactions", a ack three ring 
binder entitled "SSAI v. WWE, Stanfull Industri i пе" а 
black three ring binder entitled "SSAI у. ТОСЕ 
вец Consulting, LLC Transactions", was late 
ue to review ot those records. i 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/07/2003 


* 


A meeting was held at the office of the United Sta 


Attorney in Bridgeport, Connecticut which wag attended by SA 
Attorneys 


in Stamford, Connecticut, telephone number 
Attorneys advised that 


they represent World Wrestling Entertainment, Incorporated (WWE). 
During that meeting, attorney]  ]erovidea the following: 


Investigation on 03/05/2003 а Bridgeport, CT 


File # 196D-NH-42441 -1 Date dictated 03/07/2003 
by SA gds ADA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/15/2003 


To: New Haven 


From: New Haven b7C 
approved ү 3] @ 


Case ID #: 188B-NH-C40781=Í/ 
196D-NH-42441 ~ g 


Title: VICTIM NOTIFICATION FORM 
Synopsis: Wire & Mail Fraud 
Reference: 196D-NH-42441 Serial 1 
Details: 


CAgtName: 

PContact: Business 
BusName : World Wrestling Entertainment 
BusEIN : 000000000 
BusAcct : 

VicFirN | 
VicMidN : 
VichastN:[  ] 
SSAN : 

VicDate : 19980101 
VicDOD : 
-VicMinor: 

DOB : 

Race 

Sex 

Addr 

City 

State 

Country : 

Zip 

Email 

HPhone : 

VWrkAddr: 1241 Main Street 
VWrkCity: Stamford 
VWrkSt : CT 
VWrkCtry: US 


MDW -LILY - 


To: New Haven „Ф New Haven 
Re: 188В-МН-С40781, 05/15/2003 


VWrkZip 
WPhone 
VicPager: 
NOKFirN 
NOKMidN : 
NOKLastN: 
NOKRel 
NOKAddr 
NOKCity 
NOKState: 
NOKCtry : 
NOKZip 
NOKHPho 
NOKWPho 
NOKPager: 
GrdFirN 
GrdMidN : 
GrdLastN: 
GrdRel 
GrdAddr : 
GrdCity : 
GrdState: 
GrdCtry 
GrdZip 
GrdHPho 
GrdWPho 
GrdPager: 
PropRet : 
TotLoss : 001000000 
Lang. 
Disable 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 08/11/2003 


subpoena directed to the 


A federal 


: : : b3 FGJ 
Connecticut was served via facsi 
of Kirkpatrick and Lockhart at the 
i i eet in Pittsburgh, Pennsylvania via 
Kirkpatrick and Lockhart is one of 
the firm ing Wor Wrestling Entertainment, Inc., and 
Attorney] |... | agreed to accept service of the subpoena via 
facsimile. A copy of the subpoena and facsimile journal are 
attached hereto. 
з 
Investigation on 08/11/2003 at Bridgeport, СТ (via facsimile) 
File # 196D-NH-42441 -Q Date dictated 08/11/2003 
by SA :gds MOR bó 
b7C 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 4/20/2004 


Computer Analysis Response Team ыз Fo | 
Report of Findings 


Included herein are the findings of a digital forensic 


examination ажы by FBI CART Certified Forensic Examiner SA 
MÀ 


Request: A request was received from sf ct a 
computer and 


forensic examination of the above -= 
identified. 


Deri i 


Investigation on 4/14-19/2004 а New Haven, Connecticut 


File # 196D-NH-42441- | | Date dictated 


by A b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. А 
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FEDERAL BUREAU ОЕ INVESTIGATION 


Date of transcription 04/23/2004 


b3 FGJ 
A Federal Grand Jury Subpoena directed to thd j] 
Dulles, Virginia was 
served via facsimile to facsimile number A copy of 


the executed subpoena and the facsimile transmission verification 
report concerning the sending of the subpoena are attached hereto. 


ы ads Ol. 502. 
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File # 196D-NH-42441 42 Date dictated 04/23/2004 pé 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/10/2004 
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


Pursuant to a Fed ted to theb3 FGJ 
Dulles, 
a subscriber using e-mail account 


and which was served via facsimile on 


vided two pages of 
via facsimile. Copies of 
those two pages and the facsimile cover sheet are attached hereto. 


lods 02.302 


b6 
Investigation on 05/03/2004 at Bridgeport, CT (via facsimile) b7C 
File 4 196D-NH-42441-] 2 Date dictated 05/10/2004 
by SA gds 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/26/2004 


A Federal Grand Jury Subpoena directed to the[ j] Кои 
іп 
Herndon, Virginia was served via facsimile to 
facsimile 
A copy of the executed subpoena and the facsimile 
transmission verification report are attached hereto. 
117 ads оі. 502. 
— 
Investigation on 04/26/2004 a Bridgeport, CT (via facsimile) 
File # 196D-NH-42441 -I4 Date dictated 04/26/2004 
b6 
by SA :gds b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; ‘ 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/03/2004 
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


b3 FGJ 


in Herndon, Virginia provided 


ocuments and information responsive to a Federal Grand Jur 
Subpoena directed to е 
relating to the registration o omain name 


15S ods ді. Зог. 


Investigation on 06/03/2004 at Bridgeport, CT 


File # 196D-NH-42441 15 Date dictated 06/03/2004 


by SA :gds BE 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; gu 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 04/14/2004 


was interviewed in the offices of | 


attorney, Day, Berry an ford, Connect; and was 
accompanied by Attorney of that firm. was also b6 
represented by Attorney of the firm Kirkpatrick and bic 


Lockhart of Pittsburgh, Pennsylvania. Also present and 


participating in the interview were Assistant United States 
тез =. Special аар the 
Internal Revenue Service Criminal Investigation Division (IRSCID). 


was made aware of the identity of those conducting 
the interview and thereafter provided the following information: 


2 Stated that for the last Ld years С ]nas 
been the World Wrestling 
Entertainment, Incorporated (WWE) and duties in that regard 
include — H— The WWE, a Delaware Corporation, 
is involved in е produ professional wrestling and is a 


publicly traded company which is listed on the New York Stock 
Exchange. ' It is headquartered in Stamford with offices in Los 
Angeles, California, Toronto, Canada, London, England and a sales 
office in New York City. The original company was called Titan 
Sports which was founded in 1980. In 1982, Titan Sports bought 
Capitol Wrestling. In 1999 the name was changed to World Wrestling 
Federation and later changed again to WWE. 


The WWE's business includes merchandising and entering 
into licensing agreements with producers of various products who 
wish to use the intellectual property (IP) of the WWE, to include 
its logo and other items associated with the corporation. 
Licensing is a means to exploit the WWE's IP by getting products 
into stores and attaining wide distribution. Licenses are granted 
for the manufacture of numerous products using the IP of the WWE 
including toys, video games, T-shirts, hats and other apparel, 
games and lunch boxes. Costs rest with the licensee however 
approval of the final product remains with the WWE. The IP is 
defined in the licensing agreement and it cannot be used without 
the permission of the WWE. 


For the use of its IP, the WWE is paid royalties based on 
a percentage of the wholesale sales in the market place. The 
percentage varies with the license but is typically ten to fifteen 
percent. Each license is granted for a specific time and that also 
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varies with the license. The licensees are required to provide 
sales reports and other backup paperwork and the WWE maintains 
audit rights to examine a licensee's books and records. In this 
way, the WWE is able to confirm that what the licensee is paying is 
correct. Further, there is an accounting of the number of items 
sold relative to a particular WWE talent/superstar and in that way, 
the individual talents themselves are compensated with a percentage 
of the royalties paid to the WWE. The WWE carved out product 
groups to certain companies based on their expertise in a 
particular field. 


As to how to become a WWE licensee, С] advised that 
WWE representatives make presentations at toy fairs and similar 
functions. Also, licensing fairs and cold calls from potential 
licensees to the WWE are other sources of licensing deals. 
Sometimes the WWE initiates the licensing effort and sometimes 
people come to the WWE seeking licenses. 


Although in the past the WWE did have licensing agents in 
the United States (U.S.), currently the only such agents are 
outside the U.S. They are not considered WWE employees. 


id 1990g, WWE employee [ Û who 
was the and had other 
responsibilities at various times, includin 

i ing business as 
(SSAI), to be a Iicensing agent for the 
WWE. said he had known[  .. — |реҒоге and had worked with 
him. 


s reasoning to WWE for hiring  |ав a licensing 
agent was that p was established in the market place of 
interest to the nd could attract licensees that the WWE on its 
own might not. saka 


and afte accomplished that, there would be direct 
contact between that licensee and the WWE. The relationship 
bet e WWE and SSAI was [cce ome] The commission paid 
to 2. at about fifteen percent of the royalty paid to 
the WWE and later was reduced to eleven percent.  Licensees 
procured by[ ^  ] sent their sales data and royalty checks to the 
WWE in turn a appropriate commission via a check 
sent It was however who had the responsibility to 
manage @ license program. This included procuring and arranging 
for new licensees, and overseeing their performance. 
expected to generate most of the licensing business and was 
only supposed to be an additional source of licensing revenue. 
There was a clear delineation as to whom generated a particular 
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licensee, [_ Jor Calls to the WWE concerning licensing 
issues were directed to 


hen| фав hired by the WWE, it was with certain 

was mot to have outside licensing as the WWE was 

ith conflict of interest issues. informed the WWE 
called Rabbit Ears whic and 
іп a WII Own period concerning 

signed a document addressing WWE'S conflict of interest 


NEN 22: that] |ceeoztea to 
also a "dotte ine" connection to Vince McMahon. 


the executive group and was involved in the 
company. had annual or 1996. [ reviews whic one by 


beginning in about 1995 or 1996. as thought to be 
performing well. 


Beginning in the late 1990s, the issue arose as to why 


through SSAI was_bringing in nearly one red percent of 
nsing business. asked[ | what as doing and 
indicat he was too busy to bring in all the business that SSAI 
was doing. | ]vas not concerned that was making all the 


money . 


Concerning the relationship between THQ/Jakks, and the 
wWwE, ^ |ваіа that the WWE had a licensing agreement with a 
company called Acclaim which involved video games. That agreement 
was up for renewal and the WWE had to make a decision as to whether 
to renew it or to award it to THQ/Jakks. discussed the 
issue with There had been a payment issué With Acclaim and 
the WWE already had an existing relationship with £ 
Jakks. Ultimatel the decision as to whom the license was to be 
awarded was however it was based on information 
Ёгоц | They did not renew the Acclaim license. 


ШЕН ы already under some suspicion when the WWE 
received a check from Trinity, a T-shirt licensee, for a royalty 
payment to SSAI which was payable to SSAI. Royalty payments were 
supposed to go to the WWE and from there, payment would be made to 
SSAI by the WWE. The receipt at WWE of the Trinity check pa 
to SSAI raised a red flag in the WWE accounting department. [ч 
at Trinity said that it was а mistake апа that the chec a 
been sent in error. Bess с that there had been an issue 
with Trinity over an exclusive business deal in the past. 


v 
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with SSAI. At that time, the M 
make changes and they were not aware of the financial improprieties x 
that later came to light. m 


The WWE kept [_ Jon but later offered to b| | 
Oo tne 


with several million dollars. He sued the WWE which led t 
uncovering of all the wrongdoings perpetrated by 


The following background information was obtained 
concerning ^ ]from interview and observation: 


Name [c |] 


Race 

Sex 

Date of Birth 

Social Security Number 
Education i 


196D-NH-42441 
RCD:rcd Zeo | 


ік 


Оп August 18, 2004, AUSA — bé 
b7C 
—Ç | 


b3 FGJ 


b3 FGJ 


and advise writer if a 
subpoena, warrant, or consent will be needed to obtain the 
contraband from PWC. 
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To: New Haven Attn: File 
b6 
From: New Haven b7C 
BRA-1 / Bridgeport 


Contact: 


prattea oy: [pea ACO 


Case ID #: 196D-NH-42441 (Pending) 
Title: [—— L dba 
BELL CONSULTING, 


(SSAI); 
P . (WWE)-VICTIM; 
FBW; 


GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


— : held with сагаа Е appren s 

b6 
Details: би енен a meeting was held in the office of the b7C 
United States Attorn г ^^ attended by 


writer, A IRS CID SA as well as 


Da Berry and Howard and attorneys 
of Kirkpatrick and Lockhart. 


b3 FGJ 


“ To: New Haven ST. New Haven e 
Re: 196D-NH-42441, 08/03/2004 


wc =s 


discussed the civil case and noted 
that both ere polygr part of + 
С јавете oted that ney] b3 FGJ 
appears to be taking a position that will not 
plea NEN criminal charges. 
Prior od J ing with the civil attorneys, AUSA 
EE Везе Ch | is sched o be polygraphed by the 
on pian will be polygraphed when 
his Денең, from vacation in September. 
ausa | | am icipates pleas or grand jury indictment by October 
2004. 
%% 
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Approved By: 


жане sys [rca 2 


Case ID id: 196D-NH-42441 2 ФА ndino) 
66F-NH-A37713 


Title: [ —— — | DBA BELL CONSULTING; 
BELL LICENSING; 


вА 
(55 ; 
WORLD WRESTLING ENTERTAINMENT (WWE) Victim; 
FBW. 
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 
pBzmepsie: То set lead to review 


Details: [ ]was an employee of World benin 


Entertainment (WWE). One of duties was to obtain 


for WWE's brand. 1rected WWE licensing 
agreements to an associate, who kicked back a 


. imated loss to WWE is 
and have been sued in 


portion of his commissions t 
approximately $1.6 million. 
civil court by WWE. 


ALLRCDO!.EC, “2а 
/760- ЧО 41-411 


ЫЗ FGJ 


b3 FGJ 


Z= 


z: ; 
| Ж. 
| ў То: Мем Haven From: New Haven 


Re: 196D-NH-42441, 09/22/2004 


sent their copies of the 


AUSI = 


2004 on issues 


— if Z to determine if 


was in possession of 
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Precedence: ROUTINE Date: 07/29/2004 
To: New Haven 


From: New Haven 
BRA-1 ie 
Contact: b7C 


Case ID #: 196D-NH-42441 (Pending) 


Title: ba; 
dba; 
WORLD WRESTLING ENTERTAINMENT (WWE) - VICTIM; 


Synopsis:  Reassign case. 


Details: In light of the retirement of SA it is 
recommended that this case be reassigned to SA 

ested that „кшш T en contact with 
who is also involved in this 


Additionally, this matter is 
at the United States Attorney's 


It is su 


IRSCID SA 
investigation, 
assigned to AUSA 
Office in Bridgeport. 
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Date of transcription 10/25/2004 


Computer Analysis Response Team 
Report of Findings 


Included herein are the results of a digital forensic examination performed by a FBI 
CART Certified Forensic Examiner. This examination has been performed in accordance 
with CART policies and procedures. 


Case Reference: N/A 


Specimens: b3 FGJ 


est: SA.  f[equested assistance with captioned case ecificall 
requested a CART Examination to determine 
Sum : i ormed on the captioned evidence 
items 


Derivative Evidence (DE): 


с o t "oem 
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Disposition of Evidence: All original evidence and derivative evidence was provided to New 
Haven evidence control. 
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| Department of 

7559.9 |United States Attorney's Office District of 
Connecticut 
Press Release’ 


February 10, FORMER EXECUTIVE PLEADS GUILTY TO DEFRAUDING WWE OF 
2005, $1.9 MILLION 


The United States Attorney for the District of Connecticut announced that 
JAMES K. BELL, age 49, of 405 Silver Creek Lane, Norwalk, Connecticut, 
pleaded guilty today to a felony count of mail fraud for defrauding World 
Wrestling Entertainment, Inc. of $1.9 million. United States District Judge Stefan 
R. Underhill accepted BELL's plea of guilty this afternoon in Bridgeport federal 
court. 


As disclosed in court documents, BELL had been employed by World Wrestling 
Entertainment, Inc., (WWE), a Stamford-based company, that creates, produces 
and markets entertainment for both live and television audiences featuring 
professional wrestlers for whom WWE has developed a character profile, a 
storyline, and a role in the WWE productions. BELL had responsibilities for, 
among other things, overseeing the licensing of WWE intellectual property. It 
was part of his job description to identify potential licensees (T-shirt 
manufacturers, toy companies, etc.) to negotiate licensing agreements, and to 
develop new licensing strategies in order to benefit WWE. 


In approximately 1994, BELL arranged for SS, an unnamed participant, through 
a wholly-owned entity “SS and Associates, Inc." (55 АТ), to become a licensing 
agent for WWE. As a licensing agent, it was among SS’s responsibilities to 
identify potential licensing opportunities for WWE, negotiate new licensing 
agreements and otherwise promote WWE licensing for the benefit of WWE. 
WWE retained authority for final approval of all licensing agreements. This 
approval was usually sought from and given by BELL. 


As compensation for SS's efforts as a licensing agent, WWE agreed to pay SSAI 
a commission based upon a percentage of total revenue generated by each 
licensee procured by SSAI. Thereafter, when WWE received periodic sales 
reports and royalty payments from licensees, WWE first determined whether the 
licensee was one that had been procured by SSAI. If it was such a licensee, then 
the amount of commission due to SSAI would be calculated and a check sent, 
usually by mail, to SSAI. 


BELL today admitted that, beginning before January 1998 and continuing 
through October 2000, in the District of Connecticut and elsewhere, he and 
others devised a scheme to defraud WWE as follows: When potential licensees 
approached or contacted BELL at WWE, rather than negotiate a licensing 
agreement “in house," BELL would advise SS of the contacts so that SS could 
arrange the licensing agreements and receive commissions on those agreements. 
Similarly, BELL would advise SS that he was going to add SSAI to a pre- 
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existing licensing agreement as the licensing agent so that SSAI would begin to 
receive commission payments from those agreements, even though BELL knew 
SSAI had no entitlement to such commissions. BELL and SS agreed that the 
commissions paid by WWE to SSAI as a result of the licensing agreements 
would be evenly split between SS and BELL. Similarly, on occasion, BELL 
arranged with SSAI to receive 50% of SSAI’s commission on a particular 
licensing agreement notwithstanding that SSAI may not have procured or 
negotiated the licensing agreement. 


Thereafter, BELL completed internal documentation at WWE reflecting that 
SSAI should be paid a commission on a pre-existing licensing agreement 
notwithstanding that SSAI had no role in the procurement of the licensing 
agreement. BELL also completed and provided to the accounting department at 
WWE documents reflecting that SSAI was to receive commissions under the 
licensing agreements. As a result of the licensing agreements, WWE received 
royalties and sales reports on a periodic basis and thereafter sent to SSAI 
commission checks for commissions purportedly due. When SSAI received the 
commission checks from WWE, BELL created an “invoice” for services 
rendered by Bell Consulting, LLC and submitted the invoice to SSAI. The 
amount reflected in the invoice was for an amount equal to 50% of the 
commission paid by WWE to SSAI on the licensing agreements. SSAI then 
prepared a check payable to Bell Consulting, LLC representing the 50% kickback 
for commissions paid to SSAI on the licensing agreements. 


It was further part of the scheme to defraud WWE that BELL and SSAI agreed to 
receive and did receive a kickback from a certain licensee who manufactured T- 
shirts (the *T-Shirt licensee"). The T-Shirt licensee agreed to pay and did pay 
SSAI 2% of its sales of WWE apparel in exchange for favorable terms in its 
licensing agreement with WWE. BELL and SSAI split this 2% payment evenly. 
The total commissions paid to BELL and SS as a result of the illegal scheme 
totaled $1.9 million. 


Judge Underhill has scheduled sentencing for April 29, 2005, at which time 
BELL faces a maximum term of imprisonment of five years and a fine of up to 
$3.8 million. 


This case is being investigated by Special Agents for the Federal Bureau of 
Investigation and the Internal Revenue Service - Criminal Investigation. The case 
is being prosecuted by Assistant United States Attorney Christopher Schmeisser. 
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U.S. Department of Justice 


United States Attorney 

District of Connecticut 

Connecticut Financial Center 

157 Church Street 

P.O. Box 1824 

New Haven, Connecticut 06510 www.usdoj.gov/usao/ct 


FOR IMMEDIATE RELEASE 
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CONTACT: 


Ld 
Public Information Office 


FORMER EXECUTIVE PLEADS GUILTY TO DEFRAUDING WWE OF $1.9 MILLION 


The United States Attorney for the District of Connecticut announced that JAMES K. BELL, age 49, of 
405 Silver Creek Lane, Norwalk, Connecticut, pleaded guilty today to a felony count of mail fraud for 
defrauding World Wrestling Entertainment, Inc. of $1.9 million. United States District Judge Stefan R. 
Underhill accepted BELL's plea of guilty this afternoon in Bridgeport federal court. 

As disclosed in court documents, BELL had been employed by World Wrestling Entertainment, Inc., 
(the WWE), a Stamford-based company, that creates, produces and markets entertainment for both live 
and television audiences featuring professional wrestlers for whom WWE has developed a character 
profile, a storyline, and a role in the WWE productions. BELL had responsibilities for, among other 
things, overseeing the licensing of WWE intellectual property. It was part of his job description to 
identify potential licensees (T-shirt manufacturers, toy companies, etc.) to negotiate licensing 
agreements, and to develop new licensing strategies in order to benefit WWE. 

In approximately 1994, BELL arranged for SS, an unnamed participant, through a wholly-owned entity 
"SS and Associates, Inc." (SSAT), to become a licensing agent for WWE. As a licensing agent, it was 
among SS's responsibilities to identify potential licensing opportunities for WWE, negotiate new 
licensing agreements and otherwise promote WWE licensing for the benefit of WWE. WWE retained 
authority for final approval of all licensing agreements. This approval was usually sought from and 
given by BELL. 

As compensation for SS's efforts as a licensing agent, WWE agreed to pay SSAI a commission based 
upon a percentage of total revenue generated by each licensee procured by SSAI. Thereafter, when 
WWE received periodic sales reports and royalty payments from licensees, WWE first determined 
whether the licensee was one that had been procured by SSAI. If it was such a licensee, then the amount 
of commission due to SSAI would be calculated and a check sent, usually by mail, to SSAI. 

BELL today admitted that, beginning before January 1998 and continuing through October 2000, in the 
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District of Connecticut and elsewhere, he and others devised a scheme to defraud WWE as follows: 
When potential licensees approached or contacted BELL at WWE, rather than negotiate a licensing 
agreement "in house," BELL would advise SS of the contacts so that SS could arrange the licensing 
agreements and receive commissions on those agreements. Similarly, BELL would advise SS that he 
was going to add SSAI to a pre-existing licensing agreement as the licensing agent so that SSAI would 
begin to receive commission payments from those agreements, even though BELL knew SSAI had no 
entitlement to such commissions. BELL and SS agreed that the commissions paid by WWE to SSAI asa 
result of the licensing agreements would be evenly split between SS and BELL. Similarly, on occasion, 
BELL arranged with SSAI to receive 5096 of SSAT's commission on a particular licensing agreement 
notwithstanding that SSAI may not have procured or negotiated the licensing agreement. 
Thereafter, BELL completed internal documentation at WWE reflecting that SSAI should be paid a 
commission on a pre-existing licensing agreement notwithstanding that SSAI had no role in the 
procurement of the licensing agreement. BELL also completed and provided to the accounting 
department at WWE documents reflecting that SSAI was to receive commissions under the licensing 
agreements. As a result ofthe licensing agreements, WWE received royalties and sales reports on a 
periodic basis and thereafter sent to SSAI commission checks for commissions purportedly due. When 
SSAI received the commission checks from WWE, BELL created an "invoice" for services rendered by 
Bell Consulting, LLC and submitted the invoice to SSAI. The amount reflected in the invoice was for 
an amount equal to 5096 of the commission paid by WWE to SSAI on the licensing agreements. SSAI 
then prepared a check payable to Bell Consulting, LLC representing the 5096 kickback for commissions 
paid to SSAI on the licensing agreements. 
It was further part of the scheme to defraud WWE that BELL and SSAI agreed to receive and did 
receive a kickback from a certain licensee who manufactured T-shirts (the "T-Shirt licensee"). The T- 
Shirt licensee agreed to pay and did pay SSAI 2% of its sales of WWE apparel in exchange for favorable 
terms in its licensing agreement with WWE. BELL and SSAI split this 2% payment evenly. The total 
commissions paid to BELL and SS as a result of the illegal scheme totaled $1.9 million. 

Judge Underhill has scheduled sentencing for April 29, 2005, at which time BELL faces a maximum 
term of imprisonment of five years and a fine of up to $3.8 million. 
This case is being investigated by Special Agents for the Federal Bureau of Investigation and the 
Internal Revenue Service - Criminal Investigation. The case is being prosecuted by Assistant United 
States Attorney Christopher Schmeisser. 
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UNITED STATES DISTRICT COURT д 

EASTERN DISTRICT ОЕ МЕН YORK . x 
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UNITED STATES OF AMERICA N DIC EN 

ЕС CR 92-1276 
s cr. WE <J C 4 | 

VINCENT К. MCMAHON, JR. and (T. 18, 0.8.С., SS 37i 

TITAN SPORTS, INC., 2 and 3551, et seq.; 
d/b/a "World Wrestling T. 21, U.S.C., 55 94% (е 
Federation," 333a, and 853) KES H rd. 

Defendants. 
1 x 


THE GRAND JURY CHARGES: 
INTRODUCTION TO ALL COUNTS 

1. | From in or about 1984 until the date of the filing 
of this indictment, the defendant VINCENT K. McMAHON, JR. has 
been the Chief Executive Officer and sole owner of the defendant 
TITAN SPORTS, INC. (hereinafter "TITAN"). 

2. At all times relevant to this indictment, TITAN,. 
doing business as the "World Wrestling Federation" (hereinafter 
"WWF"), operated an entertainsénk and sports business presenting 
professional wrestling exhibitions throughout the United States 
and around the world. WWF featured WEBBER performers whose 
physiques were characterized by unusually Таға апа well-defined 
muscles. 

3. Тһе United States Food and Drug Administration 


(hereinafter "FDA") is the federal agency charged with the 


responsibility of protecting the health and safety of the 


American public by ensuring that drugs are safe and effective 
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before they may be manufactured and dispensed. FDA is also 
responsible for ensuring that approved drugs are manufactured and 
stored under conditions designed to promote their safety and 
effectiveness; that ——" drugs are properly labeled to inform 
the public of medically approved usage; and that prescription 
drugs, because of their potential toxicity and harmful side 
effects, are distributed to individuals for use only when such 
use is supervised by a licensed medical practitioner acting 
within a legitimate Geeta patient relationship. 

4. Anabolic, androgenic Steroids (hereinafter 
"steroids") are chemical derivatives of testosterone, the male 
sex hormone. At all times relevant to this indictment, steroids | 
have been classified as prescription drugs by the FDA. | | 

5. . Certain athletes and body-builders determined that 
steroids can increase muscle development and can enhance athletic 
performance and physical appearance. However, the FDA has not 
approved the use of steroids to enhance athletic performance or 
physical appearance. Because of the legal limitations on access 
to steroids, various other ‘sources developed which circumvented 
the regulatory controls enforced by the FDA, principally unlawful 
and unregulated sales of steroids by unauthorized distributors 
and licensed physicians who prescribed steroids for purposes 
other than the treatment of disease. 

6. In 1988, in response to increased incidents of 
illegal steroid distribution to athletes, Congress enacted 


legislation specifically prohibiting the possession with intent 
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3 
to distribute, and the distribution of, steroids for any purpose 
other than the treatment of disease in humans. 

7. George T. Zahorian, III, named herein as an 
unindicted coconspirator, at all times relevant to this 
indictment was an osteopathic surgeon licensed in the. state of 
Pennsylvania. Throughout the 1980s, Zahorian was assigned to 
attend WWF exhibitions in Pennsylvania by the Pennsylvania 
Athletic Commission.  Zahorian, with McMAHON's knowledge and 
approval, distributed steroids to wrestlers who performed at WWF- 
sponsored exhibitions. 

8. In 1989, the Pennsylvania Athletic Commission 


deregulated wrestling and no longer assigned Commission doctors 


to attend wrestling exhibitions, but only required the presence 


of a licensed physician to be paid by the promoter. Following 
this deregulation, in 1989 Zahorian appeared at a WWF exhibition 
and was paid by TITAN for his appearance. Later still in 1989, 
TITAN engaged Zahorian to be the attending doctor at another WWP 
exhibition to be held in Hershey, Pennsylvania. Before the event 
took place, however, TITAN officials, including McMAHON, learned 
of a federal investigation into Zahorian's activities, warned him 
of the investigation, and prevented him from appearing at that 


exhibition and any future WWF exhibition. 
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COUNT ONE 
(Conspiracy) 


9. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 

10. From in or about 1985 until in or about February 
1991, both dates being approximate and inclusive, within the 
Eastern District of New York and elsewhere, the defendants 
VINCENT K. McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World 
Wrestling Federation," together with others including George T. 
Zahorian, III, did knowingly and intentionally conspire to 
defraud the United States and to commit offenses against the 
United States, namely: 

a. to defraud the United States, in particular, 
the FDA, by impairing, impeding and defeating its 
efforts to regulate and control the manufacture and 
distribution of steroids within the United States, in 
violation of Title 18, United States Code, Section 371; 

b. to introduce and deliver for introduction 
into interstate commerce, with the intent to defraud 
and mislead, drugs that were misbranded within the 
meaning of Title 21, United States Code, Section 353(b) 
in that the drugs were prescription drugs distributed 
without a prescription, in violation of Title 21, 
United States Code, Sections 331(a) and 333(a) (2) 
(formerly Title 21, United States Code, Section 


333 (b)); 
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5 
c. to cause, with intent to defraud and mislead, 
the misbranding of drugs within the meaning of Title 

21, United States Code, Section 353(b) while such drugs 

were being held for sale, in that the drugs were 

prescription drugs distributed without a prescription, 
in violation of Title 21, United States Code, Sections 

331(K) and 333(a)(2) (formerly Title 21, United States 

Code, Section 333(b)); and 

d. to knowingly distribute and possess with 
intent to distribute steroids for use in humans other 
than the treatment of a disease pursuant to the order 
of a physician, in violation of Title 21, United States 

Code, Section 333(e)(1). 

11. An object of the conspiracy was unlawfully to 
provide WHF wrestling performers with steroids to enhance their 
size and musculature, and thereby to increase the ticket sales 
for WWF exhibitions and the profits to TITAN and McMAHON. 

12. In furtherance of the conspiracy and to effect the | 
objects thereof, within the Eastern District of New York and 
elsewhere, the defendants TITAN and McMAHON and others committed 


the following: : 
OVERT ACTS 
a. On several occasions in or about and between 
1985 and February 1991, Zahorian ordered, paid for and received 
shipments of steroids, including but not limited to Nandrolone 


Decanoate (commonly known as "Deca") from a pharmaceutical 
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company located in Westbury and Rockville Centre, Long Island, 


- 


Мем York. 
b. On several occasions in or about and between 


1985 and February 1991, Zahorian distributed steroids to WWF 


`. 


wrestling performers at exhibitions and via express delivery 
shipments. 

c. On several occasions in or about and between 
1985 and February 1991, TITAN presented wrestling exhibitions at 
the Nassau Veterans Memorial Coliseum in Uniondale, Long Island, 
New: York. 


d. On several occasions in or about and between 


March 1988 and October 1989, McMAHON ordered and caused to be 
ordered Nandrolone Decanoate from Zahorian. 

e. On several occasions in or about and between 
March 1988 and October 1989, to evade the detection of these 
transactions, McMAHON utilized TITAN funds or resources to cause 
the purchase of bank checks used to pay Zahorian for shipments of 
Nandrolone Decanoate. 

f. On several occasions in or about and between 
March 1988 and October 1989, McMAHON distributed and caused to be 
distributed Nandrolone Decanoate to a WWF performer known to the 
Grand Jury. i 

g. During the period from in or about August 
1989 to in or about November 1989, TITAN executives instructed an 


employee of TITAN known to the Grand Jury to kire Zahorian as the 
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E attending doctor at a WWF exhibition to be held in Hershey, 
Pennsylvania in December 1989. 

h. On or about December 1, 1989, a TITAN 
executive known to the Grand Jury sent a memorandum to another 
TITAN executive known to the Grand Jury discussing the fact that 
Zahorian was under investigation and instructing the executive 
(i) to ensure that Zahorian did not attend an upcoming TITAN 
exhibition and (ii) to consider warning Zahorian of the existence 
of the investigation. 

i. In or about December 1989, McMAHON and a 
TITAN executive known to the Grand Jury discussed informing 
Zahorian that he was under investigation by law enforcement 
authorities. 

js In or about December 1989, a TITAN executive 
known to the Grand Jury had a telephone conversation with 
Zahorian and directed him to destroy any records of Zahorian's 
contact with WWF or WWF wrestling personnel. 

k. In or about March 1990, McMAHON had a 
conversation with a WWF performer known to the Grand Jury. 

i. On or about January 25, 3591, MCMAHON 
instructed all WWF wrestlers using steroids to carry a 
prescription.for such steroids at all times. 


(Title 18, United States Code, Sections 371 and 3551 et 


seq.). 
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COUNT TWO 
(Possession With Intent To Distribute Anabolic Steroids) 


13. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 

14. On..or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendant TITAN SPORTS, 
INC., d/b/a "World Wrestling Federation," together with others 
including George T. Zahorian, III,, did knowingly and 
intentionally possess with intent to distribute to Vincent K. 
McMahon, Jr. a substance containing anabolic steroids for use in 
humans other than for the treatment of disease pursuant to the 
order of a physician. e 

(Title 18, United States Code, Sections 2 and 3551 et 


seq.; Title 21, United States Code, Section 333(e)(1)). 


COUNT THREE 
(Possession With Intent To Distribute Anabolic Steroids) 


15. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 

16. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendants VINCENT K. 
MCMAHON, JR. and TITAN SPORTS, INC., d/b/a "World Wrestling _ 
Federation," together with others including George T. Zahorian, 
III, did knowingly and intentionally possess with intent to 


distribute to a WWF performer known to the Grand Jury a substance 


10 


19. By virtue of the commission of one or both of the 
felony offenses alleged in Counts Two and Three of this 
indictment by the defendants VINCENT K. MCMAHON, JR. and TITAN 
SPORTS, INC., d/b/a "World Wrestling Federation," any and all 

' interests each defendant has in the above-described property is 
vested in the United States. 

20. In the event that any property, real or personal, 
involved in the offenses described in this indictment or any 
property traceable to such property, as a result of any act or 
omission of the defendant VINCENT K. MCMAHON, JR. or the 
defendant TITAN SPORTS, INC., d/b/a "World Wrestling Federation" 

(1) cannot be located upon exercise of due 

diligence; 

(2) has been transferred, sold to, or deposited 

with, a third party; ` 

(3) has been placed beyond the jurisdiction of 

the court; ; ` 

(4) has been substantially dininished in value; 

or 

(5) has been commingled with other property which 

cannot be divided without difficulty, 
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the forfeiture of any other property of the defendants, ир to the 
value of the property described above in Paragraph 18, is 
demanded to be forfeited to the United States. 


(Title 21, United States Code, Sections 333a апа 853). 
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STATEMENT OF FACTS AND CIRCUMSTANCES 


Defendant property, 1241 East Main Street, -Stamford, 
CT., was indicted at CR93-1276, Eastern District of New York, on 
11-18-93. (see áttached Indictment) 


The Indictment seeks to forfeit the corporate 
headquarters of TITAN SPORTS, INC., t/d/b/a/ the "WORLD 
WRESTLING FEDERATION", 1241 Bast. Main Street, Stamford, and all 
interests of the defendants in that property for violations of 
Title 21 U.S.C. 333(a) and 853. 
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FD-635 (Rev. 5-15-87) Record of Seized Property Federal Bureau of Investigation ` 
1. Seizure Number 2. Seizure Office File 3. Office of Origin 4. OOFile Number 5. Primary Violation Code | 6. Secondary Violation Code 
3540-94-I-030 | NY-234993 NEW YORK 234993 N 
7. Date 635 Prepared 8. Case Caption /b/a, WORLD WRESTLING FEDERATION; 
12-8-93 TITAN SPORTS, INC., STAMFORD CT.; FBW; MF; OO:NY 


9. Associated Action Code | 10. Administrative or Judicial | 11. Property Code 
с J H 


12. JointAgency 


NONE 


15. Official Uso 
O Yes 8 No 


13. Processing Agency 


14. Appraised Value 
$9,000,000.00 
17. Date Claimant Notified of Disposition 18. Date U.S. Marshals Notified 


FBI 


16. Forfeiture Deferred 
Yes XXNo 


19. Agency 


20. VIN/Serial Number 


un a 
27. Cylinders 28. Mileage 29. License Number/ 30. Equipment/Accessories 
State/Year 


32. Description of Other Property 


26. Condition Code 


31. Repairs Needed 
REAL PROPERTY: 
1241 EAST MAIN STREET, STAMFORD 


33. Case Agent 34. Seizure Method 35. Subjectin Custody/Date 
D Yes @ No 
36. Date Seized 37. Place Selzed - Street Address 38. City 39. State 40. ZIP 
11/18/93 1241 EAST MAIN STREET STAMFORD CT 06902 


41. Date Adopted 42. Agency 


43. Place Adopted - Street Address 44, City 46. ZIP 
— ui 
52. Registered To - Name 53. Street Address 54. City 55. State 56. ZIP 
SEANCHED 77] —— r0 
RIALIZED | M 
57. Attorneys Name 58. Street Address 59. City 60. StatDEXED |6. 2р 7 
s чад тс 
FILED _ Ç [mem (1) 
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62. Amountof Lien 63. Name/Title of Lienor 
64. Street Address 65. City 66. State 67. ZIP 
68. Quick Release 69. Expenses Reimbursed 70. Name/Title 


71. Steet Address 72. Сау 74. 21Р 
75. Storage Facility 76. Street Address 77. City 


83. Storage Expense Per Day 84. Repair Expense 


80. Date Stored 


81. Seizure Expense 82. Transportation Expense B5. Appraisal Expense 


86. Name/ID Number of Prisoner 87. Name of Institution 

88. Street Address 89. City 90. State 91. ZIP 

92. Name/ID Number of Prisoner 93. Name of Institution 

94. Street Address 95. City 96. State 97. ZIP 

98. Name/ID Number of Prisoner 99. Name of Institution 

100. Street Address 101. City 102. State 103. ZIP 

104. Name of Additional Individual 105. StreetAddress * 107. State 108. ZIP. 
Requiring Notice 

109. Name of Additional Individual 110. Street Address 112. State 113. ZIP 
Requiring Notice 


114. Facts and Circumstances Surrounding Seizure Attached With Documentation 
SEE ATTACHED STATEMENT OF FACTS AND 


CIRCUMSTANCES WITH INDICTMENT. THE PROPERTY REPRESENTS AN INDICTED ASSET 
SUBJECT TO CRIMINAL FORFEITURE, AND IS A STATISTICAL REPORTING. VALUE OF 


PREMISES GAINED FROM PUBLISHED REPORTS. 


_——— ا 


PAPERWORK SUBMITTED BY SA | 


115. FA Signature 116. PLA Signature/Date 117. Sharing 
© Yes Ж No 
b ° 118. Award Recommended 
b7C 


5 NO 


Memorandum 


Te : PA |(66ғ-мү-191903 SUB II) De 12-8-93 
nen ss [— — — — Jen 


Subject: SIGNING OF Ер-63575 


SEIZURE %: 3540-94-1-030 


case TITLE: [baa 

WORLD WRESTLING FEDERATION; 
. TITAN SPORTS, INC. 

STAMFORD, CT 

FBW; ME; OO:NY 
DEFENDANT PROPERTY: 

REAL PROPERTY; 1241 EAST MAIN STREET 
STAMFORD, CT 


Attached for your review is a FD-635 package relating 
to the above seizure. 


If you concur, please sign the FBIHQ copy and the case 
file copy with full signature on line 116 and return the copies 
to me. 


If additional information is needed to complete the 


seizure package, advise me and the information will be assembled 
for your review. 


i-e] 5s 
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FD-635 (Rev. 5-15-87) Record of Seized Property Federal Bureau of Investigation 
. 4 Seizure Numbegs 3. Office of Origin . . PrimaryViolation Code | 6. Secondary Violation Code 
3540-13 F -pa - 
f ACE Ay 
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12. JointAgency 


NOME 


. Processing Agency 15. Official Use 


О Yes No 


= 


17. Date Claimant Notified of Disposition 


j. Forfeiture Deferred 18. Date U.S. Marshals Notified 
D Yes pras 


19. Agency 
20. VIN/Seríal Number 21. Year 22. Make 23. Model 24. Stylo 25. Color 
26. Condition Code 27. Cylinders 28. Mileage . License Number/ 30. Equipment/Accessories 


State/Year 


А D 
31. Repairs Needed 32. Description of Other Property Von ро 
(241 Саа MOMS. 


35. Subjectin Custody/Date 
D Yes paso 


38. City I 39. State 40. ZIP 
VENPE 


34. Seizure Method 


36. Date Seized 


ШІНДЕ, 


37. Place Seized - Street Address 


Al Еле” Matal S77 


41. Date Adopted 142. Agency 
43. Place Adopted - Street Address 44. City 45. State 46. ZIP 
47. Seized From - Name 48. Street Address . City 50. State 51. ZIP 


52. Registered To - Name 53. Street Address . Ci 55. State 56. ZIP 


57. Attorney's Name 58. Street Address . Ci 60. State 61. ZIP 


ҒВ/ООЈ 


Instructions 


Seizure Number: Enter cost code, fiscal year item was seized, the type of 
forfeiture case (see Case Type Code) and seizure number, e.g., 3450-86-f-001. 
Seizure Office File Number: Enter substantive file number of office who 
actually seized property, e.g., 245A-186. 

Office Of Origin: Enter alpha designator of office who initiated case. 

OO File Number: Enter substantive file number of office who initiated case. 
Primary Violation Code: Enter primary violation code under which property 
was seized. 

Secondary Violation Code: Enter violation code (if applicable) under which 
property was seized. 

Date FD-635 Prepared: Enter date 635 was prepared. 

Case Caption: Enter title of case. 

Associated Action Code: Enter applicable associated action code per 
Associated Action Code list. 

Administrative or Judicial; Enter if the case if being forfeited administratively 
or judicially. 

Property Code: Enter applicable property code per Property Code List. 

Joint Agency: ‘Enter other agencies who participated in seizure. 

Processing Agency: Enter lead agency processing property. 

Appralsed Value: Enter appraised value of property. 

Official Use: Enter if property is suitable for official use. 

Forfeiture Deferred: Enter yes if this property is being seized for forfeiture and 
later turned over to another authority for disposition. FBIHQ authority 
required prior to deferring property seized for administrative forfeiture. Attach 
explanation for reason for deferral and identify agency in Block number 19. 
Date Clalmant Notified of Disposition: Enter the date the claimant was 
notified of disposition. 

Date U.S. Marshals Notified: Enter the date the USMS was notified of 
disposition of property. 

Agency: Enter the identity of the agency to whom deferral was made. 
ViN/Serial Number: Enter the vehicle identification number or serial number of 
the property seized. 

Year: Enter the model year of the property. 

Make: Enter the manufacturer of the property. 

Model: Enter manufacturer's model/brand name. 

Style: Enter distinctive characteristics of property, e.g., 2-door, 4-door, pick-up, 
etc. 

Color: Enter color of conveyance seized. 

Condition Code: Enter applicable condition code per Condition Code List. 
Cylinders: Enter number of engine cylinders of conveyance. 

Mileage: Enter current mileage of conveyance. 

License Number/State/Year: Enter license or other identifying number of 
conveyance including state of registration and year, e.g., boat registration, 
aircraft tail number, etc. 

Equipment/Accessorles: Enter equipment and accessories that are on the 
property. 

Repairs Needed: Enter any repairs of property that are needed. 

Description of Other Property: Enter property other than conveyances, e.g., 
currency, furs, real property, etc. (serial numbers should be shown under Block 
number 20). 

Case Agent: Enterthe name of the Agent whois responsible for management 
ofthe substantive case which resulted in the seizure. 

Selzure Method Code: Enter applicable seizure method code per Seizure 
Method Code List. 

Subject In Custody/Date: Enter if subjectis in jail and date of incarceration. 
FSPU should be advised if prisoner is released and a contact address should be 
obtained from the parole office. Blocks 86-103, as applicable, should be 
completed. 

Date Seized: Enter date property was seized. 

Place Selzed: Enter street address, city, state and zip code where property 
was seized. 

Date Adopted: Enter date the seized property was turned over to FBI. 
Agency: Enterthe agency from whom the FBI adopted the forfeiture action. 
Place Adopted: Enter street address, city, state and zip code where FBI 
adopted property seized. 

Seized From: Enter name of person from whom property was seized. 


moo > 
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Primary/Secondary Violation Cod 


15 USC 1177 - Gambling Devices 
17 USC  506/ 
5097  - Copyright Infringement 
Devices 
18 USC 512 - Motor Vehicle Theft 
18 USC  793/ 
794 - Forfeiture of Proceeds 
Derived from Espionage 
Activities 
18 USC  981/ 
982 - Money Laundering 
18 USC 1465 - Obscene Materials 
18 USC 1762 - Prison Made Goods 
18 USC 1955 -Property Used in legal 
Gambling 
18 USC 1963 -RICO 
18 USC 2253/ 
2254 - Child Protection 
18 USC, 2318 - Trafficking in Counterfeit 
Labels 
18 USC 2513 - Illegal Wire Intercept 
Devices 
18 USC 366 - Bribe Money Offered 
in Evidence 
21 USC 853 - Controlled Substances 
21 USC 881 - Drugs/Related Assets 
22 USC 401 - Arms/Munitions of War 
Property Code 
Aircarít 
Vessel 
Cash 
Other Financial Instruments 
Electronic Equipment 
Food 
Weapons 
Real Property 
Jewelry and Precious Stones 
Clandestine Lab Equipment, 


Chemicals, etc. 


Animals, e.g., livestock, 
exotic birds, etc. 


Business Interests, part 
or whole 


Art, Antiques 
Other 
Vehicles 


62. 


75. 


81. 


86. 


92. 


98. 


Amount of Lien 


. Street Address 


, Quick Release 


Street Address 


Storage Facility 


Seizure Expense 


Name/ID Number of Prisoner 


. Street Address 


Name/ID Number of Prisoner 


. Street Address 


$$ 
ue 


Name/ID Number of Prisoner 


100. Street Address 


104. Name of Additional Individual 


Requiring Notice 


109. Name of Additional Individual 


115. FA Signature 


Requiring Notice ` 
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63. Name/Title of Lienor 


65. City 66. State . 67. ZIP 


69. Expenses Reimbursed 70. Name/Title 


_ 
76. StreetAddress 78. Stato 79.ZIP 80. Date Stored 
82. Transportation Expense 83. Storage Expense Per Day 84. Repair Expense 85. Appraisal Expense 


87. Name of Institution 


89. City 90. Stato 91. 2iP 
93 


. Name of institution 
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99. Name of Institution м”, £ 


101. City 102. State 103.ZIP 
106. City 107. State 108. ZIP 


111. City 112. State 113. ZIP 


105. Street Address 


110. Street Address 


116. PLA Signature/Date 117. Sharing 


О Yes |Б Фо 


118. Award Recommended 


84. 
85. 
86. 


92-103. 
104-113. 


87. 


88-91. 


114. 


115. 
116. 


117. 


118. 


Street Address, City, State, ZIP: Enter address of person from whom 
property was seized resides. 
Registered To: Enter name of person to whom property is registered or 
owned. 
Street Address, City, State, ZIP: Enter street address, city, state and zip 
code of person to whom property is registered to resides. 
Attorney's Name: Enter name of attorney who is representing the individual 
from whom the property was seized or owned. 
Street Address, City, State, ZIP: Enter street address, city, state and zip 
code where attorney can be noticed at. 
Amount of Lien: Enter amount of any lien or encumbrance on the property. 
Name/Title of Lienor: Enter name and/or title of lienor or person having а 
monetary interest in the property. 
Street Address, City, State, ZIP: Enter street address, city, state and zip 
code where lienor or person is located. 
Quick Release: Enterif property has been quick released. 
Expenses Relmbursed: Enter dollar amount of expenses reimbursed. 
Name/Title: ‘Enter name and title to whom property was returned. 
Street Address, City, State, ZIP: Enter street address, city, state, and zip 
code of the party to whom the property was returned. 
Storage Facility: Enter name of storage facility where property is retained. 
Street Address, City, State, ZIP: Enter street address, city,state and zip 
code where storage facility is located. 
Date Stored: Enter date the property was stored. 
Selzure Expense: Enter all expenses relating to seizure of the property, e.g., 
locksmith, title search, etc. 
Transportation Expense: Enter all expenses relating to movement of the 
property, e.g., gasoline, oil, etc. 
Storage Expense Per Day: Enter all expenses relating to storage per day of 
the property seized. 
Repair Expense: Enter all expenses relating to repair of the property seized. 
Appralsal Expense: Enter appraisal costs. 
М№атело Number of Prisoner: Enter name and inmate number of person 

. arrested during seizure. 
Name of Institution: Enter name of institution where prisoner is being 
detained. 
Street Address, City, State, ZIP: Enter street address, city, state and zip 
code of location of institution. 
Refer to Number 86. 
Name of Additional Individuals Requiring Notice: Enter name and full 
address of additional individuals requiring notification. 
Facts & Circumstances Surrounding Selzure: Prepare a concise and 
brief statement of the facts of the forfeiture investigation including the statute 
violated, a description of the property seized and the facts that demonstrate 
the prohibited activity. 
ҒА Signature: Self-explanatory. 
PLA Signature: The PLA is reponsible for ensuring forfeiture procedures 
and legal requirements are met and specifically approving the statement of 
facts and circumstances which meets the probable cause standard. 
Sharing: Enter if a sharing request has been submitted. 
DAG 71 and 72 attached. 
Award Recommendation: Enter yes if individual(s) furnished substantial 
information or assistance which led to seizure. If yes, on separate sheet 
furnish name of individual(s) with identifying data, e.g., DOB, and percentage 
of the award recommended realizing that the maximum percent to be awarded 
is 2596 of the amount realized by the Government from the sale or use of the 
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Тһе following was obtained through observation апа 


interview: 


Name: [ o | 
Sex: ale 

Race: i 

Date of Birth: 

Place of Birth: 


Current Address: 


Social Security 
Account Number: 


Investigation on 1/7/93 at Philadelphia, Pa. File f. 196B-NY-234993 = 


. b6 
by ] Date dictated. 1/9/93 b7C. 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


. ж 


FD-302a (Rev. 11-15-83) 


196B-NY-234993 


—— |0 ал rue E 


b3 
b6 
Height: 5’ 10" approximately b7C 
Weight: 
Hair: 


cC c 


-1- 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/ 19/ 93 


b3 
appeared at the office of Assistant United States Attorne 
The following was obtained through observation and 
interview: 
Sex: ale 
Race: White 
Date of Birth: [Ld 
Place of Birth: iti 
Address: 
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The following was obtained through observation and 
interview: 
Sex: ale 
Race: i 
Date of Birth: 
Place of Birth: Unknown 
Social Security 
Account Number: 
Address: 
Telephone Number: 
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The Houston Chronicle, March 15, 1992 
knowledge of Hogan’s drug use, were not so reticent. 
"nI compare Hulk Hogan to (fo r Washington, D.C., mayor) 
Marion Barry,'' said Superstar B (whose real name is e Coleman), 


the one-time villainous heavyweight c ion of the 
World Wrestling Federation. ""Barry Went to schools and talked to ^ 
kids about not doing drugs and at the same time had crack cocaine 

in his pants pocket. Hogan is a liar to the children, because all 

the time he is saying "I'm not uging steroids. ' I think that was 

the most disgusting thing you could do in this country with the 

drug situation the way it is. '' 

Graham admitted hig own steroid abuse a few years ago after 

having several hip and ankle operations that he attributes to 
degenerating bone and muscle tissue caused by steroids. Now Graham 
lectüçes at schools about steroid abuse. 


Bar Orton, who wrestled under the name Barry O, recalls in 
his unpubNshed book ""Wrestling Babylon’’ his associations with 
Hogan. Їп 1983, ""I ran into him (in Las Vegas) and he was really 
friendly, asking about my brother Bob (also a wrestler) and this 
and that and he asked me, "Can you get some, соке? ' 


""It so happened that I knew someone and so I gave that 
Someone a call and that someone showed up soon thereafter. Tt 
became a regular thing . . . It was a routine. Hogan, of course, 
wasn't the only customer. After the matches we'd all go up to a 
room and indulge. '' 


Hogan moved back to the WWF in 1984 and in his first match 
that January won the world title by beating the Iron Sheik. 


Hogan was never more popular than at Wrestlemania III in 
March 1987, when 90,817 filled the Silverdome in Pontiac, Mich., to 
watch Hogan defeat his last great adversary, Andre the Giant. That 
year, Graham said, on three occasions -- ín Detroit, St. Louis and 
San Francisco -- he injected Hogan with steroids. 


In 1988, Hogan started to cut back on his wrestling schedule, 
generally working weekends and major pay-per-view cards. Ав the 
biggest name in the prospering professional wrestling world, he was 
reportedly able to dictate when he wanted to work. At the game 
time, he pursued a movie career, starring in ""No Holds Barred,'' a 
movie about a wrestlex. 


Today, Hogan’s income is Closely guarded. But estimates range 
between $ 2 million and $ 6 million a year, including merchandising 
fees. But his сахеех in the United States may be over after next 
month's Wrestlemania VIII pay-per-view event, Promoter McMahon said 
Hogan is taking an indefinite hiatus. 


""It might be for six months, it might be for a year, it 


might be forever, we don't know,'' McMahon said. ""Hulk Hogan, the 
character, will always be associated with the WWF. Whether Terry 


Bollea will be is a matter of conjecture. '' 
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company is said to be worth somewhere between $ 150 million and $ 500 
million. 


But the WWP's claim to presenting ""family entertainment'' 
has been tarnished by several embarrassing incidents. 


This year, the WWF has suspended two/of its best known 
wrestlers. rich (the so-called Texas Т > whose real 
name is Ker ishon) was arrested in Richardson £o allegediy 
forging drug prescriptions. He has entered а drug rehabilitation 
program, and his case Мв (half of the tag 
team The\Rockers) was arrested in Tampa, Plà., for allegedly 
possessing cocaine, drug paraphernalia and ré isting arrest. The 
саве is pending and he is wrestling in Japan, 


Perhaps the most damaging Blow for the WWF came during the 
dune 1991 trial of George Zahorian, а Harrisburg, Pa., urologist 
who was convicted on 12 counts о selling steroids for non-medical 
purposes. 


Hulk Hogan (whose real name is Texry Bollea) was Bubpoenaed 

because he was one of the five wrestlers to whom Zahorian wa 
accused of ‘selling steroids. But the U.S. attorney agreed to waive 
Bollea's testimony because his ""privàte and personal'' matters 
“outweighed any passible contribution tŠ the trial. Wrestlers Rod 
er (real name Blair (his xeal name), 
Rich Martel (Richard Vignault) and Dan Spive 8 real name) all 
admitted to buying st&roids from Zahorian\ fn addition, Zahorian 
testified that he treated Bollea as a serious steroid abuser and 
successfully got him off steroids. 


Federal Express records obtained by the grand jury in the 

case show that Zahorian sent packages to Bollea on eight occasions 
during a nine-month period in 1988. Thirty-four packages were sent 
during the same period to the WWF's headquarters -- which has an 
unlisted phone number -- in Stamford, Conn. An additional eight 
packages were sent to McMahon at other addresses. Тһе four 
wrestlers who testified all admitted receiving steroids from 
Zahorian by Federal Express. 


McMahon acknowledges he experimented with steroids for a 
short time and received them by Federal Express from Zahorian. 


However, he says that they were legal at the time and he does not 
condone their use. Possession of steroids for non-medical purposes 
has since been made illegal. 


A furor erupted ir the wrestling. community two weeks after 
Zahorian was convicted. Hogan went on Arsenio Hall’s show to repair 
his image. "wr am not a steroid abuser,'^ he declared, ""and I do 
not use steroids. '' 


McMahon says of Hogan’s television appearance: ""I think Hulk 
told the truth, but maybe not the. whole truth. '' Hogan declined to 
be interviewed, a WWF spokesman said. Others, claiming firsthand 
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Haynes, а former World Wrestling Federation wrestler who now 
competes indepéndently. ""It’g all brought on the promoter 
because he asks\too much out of you. You're onlyNa human being, but 
you're just a number to him. '' 
Ivan ""Polish Power'' Putski (real name Joseph Bedn ), & 
former  wregtler, Steroidg:  ""It'g Something You have to do. 


I didn’t want to take them but I had to because I didn’ want the 
other guy to look better than me. . . It'g а vicious circle until 
you retire. ”” 


Professional wrestling for years was a backwater form of 
entertainment concocted by television in the 19508. The Country was 
divided into regions, all with local promotions. 


The setting was usually the small, smoky arena, usually 
before a few thousand people. Wrestlers would travel, often in the 
same Car, from town to town renewing their rivalry in the same 
manner -- and with the same ending -- as the night before. 


Ап American passion play of good versus evil, the ""sport'' 
drew upon stereotypes left over from the war: the Japanese, German 
and Russian wrestlers were always bad. Wrestlers were usually 
portrayed as back-room brawlers or scientific wrestlers, meaning 
those whc did not cheat. There were no superhuman figures, only 
good ol’ boys who could give and take a solid punch, с. 

of 


The son of a longtime promoter in the Northeast, 

took advantage of cable television and went national wi 

his World Wrestling Federation. He signed a deal with the USA cable 
network and syndicated his show through the country. 


Everything changed in the early 1980s, compliments Vinee 


In 1984, McMahon tied wrestling to rock music, using MTV and 
rock stars such as Cyndi Lauper, and cultivated a new and 
predominantly young audience. What he needed was a star bigger than 
life. And so began the rise of Hulk Hogan. 


It was in 1985 that McMahon broke open the spoxt with a rigky 
closed-circuit venture called Wrestlemania. Не brought in 
television actor Mr. T to tag team with Hogan against two bad guys. 


He engineered the pair onto ""Saturday Night Live'' and David 
Letterman’s show, and suddenly wrestling was the campy new 
entertainment of yuppies. 


McMahon arranged fo get & wrestling show on once a month in 
the ""Saturday Night Live’’ time slot. Wrestling took off. 


Merchandising was cranked up on a large scale as McMahon marketed 
to kids with action figures, championship belts and clothing. 


According to industry magazines, the WWF did more in gross 
merchandising last year ($ 1.7 billion) than the NFL. Today, the 
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LENGTH: 1675 words 
HEADLINE: Wrestling, star Hogan in peril amid steroid abuse accusations 
BYLINE: JOHN CHERWA, HOUSTON MITCHELL; Los Angeles Times 


BODY: 
Every weekend, millions of children -- and quite a few adults 
-- suspend reality for a few hours, plant themselves in front of 
the television and wait for the self-proclaimed real American hero 
to appear. 


Professional wrestler an -- 6-foot-6 and 290 pounds 
of muscle -- bounds to the screen and urges his littie Hulksters to 
Say their prayers, take their vitamins and believe in themselves. 


Hogan is a Saturday morning cartoon come to life -- and the 
star of a merchandising empire that grossed $ 1.7 billion last year. 
Hogan is in demand as a celebrity spokesman, doing commercials for 
Right Guard, Honey Nut Cheerios and Hasbro wrestling figures. There 
are almost 300 official Hulk Hogan products, all aimed at children, 
from dolls to vitamins and pillowcases. 


But Hulk/Hogan's image is in peril, and so is that of all of 
professional wrestling. Hogan is accused of having abused steroids 
and cocaine. And professional wrestling is said to be rife with 


— 


steroid abuse, at the very least. . 


For Hogan, whosa size and rise seem to personify what 
professional wrestling has become in America, troubles mounted when 
he turned up on Arsenio Hall'g television show to quash reports 
that he was a heavy steroid user. He declared that he has only used 
Steroids on three occasions, all under doctor's care to 
rehabilitate muscle injuries. 


The outcry was immediate. Former wrestlers came forward to 
Bay that Hogan was lying. They say they have personal knowledge of 
his drug abuse. They say you can't make it big in professional 
wrestling without drugs. =< 

The need to be massive and musculax ig now de rigeur for 
professional wrestlers and, with the constant travel, that can 
require some extra help. Not to mention the relief many seek for 
the pain from the sport’s bumps and falls. 


""VYaliums, Placidyls, acid, pot, steroids, cocaine, alcohol 
are all a major part of professional wrestling,’’ said Billy Jack 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/19/93 


nuary 14, 1993, also known as (aka) ЫЗ 
= eared at the office of the Assistant United 


t he was part of the WORLD 


FEDERATION (НҰР) since| — and had previously worked sx | 


[— -]stated that he had current knowledge about| | 


and others and that the WWF ha 
confronted co i i 


The following was obtained through observation and 
interview: 


Name: 

Height: 

Weight: 

Date of Birth: 
Place of Birth: 
Address: 


Social Security 
Account Number: 


Arrests: No prior arrests. 
eee 
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TO FBI PHILADELPHIA/ROUTINE/ 
BT 
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CITE: //3540// 


SUBJECT: [a WORLD WRESTLING FEDERATION (WWF) 


STANFORD CONN., FRAUD BY WIRE; MAIL FRAUD, OO:NY. 
RE мү ssA dro ssa [_ Јаџгтџәз. 
FOR INFORMATION OF PHILADELPHIA OFFICE, SINCE 11/20/92, 


NY FBI HAS BEEN INVOLVED IN ABOVE INVESTIGATION, SPECIFICALLY سے‎ 


(2 івстовер А FRAUD BEING PERPETRATED ON THE PUBLIC BY A e 
2 a 


THE EASTERN DISTRICT OF NEW YORK HAS BEEN INVOLVED ІМ 
THIS INVESTIGATION SINCE MARCH OF 1992 AND HAS RECENTLY 


REQUESTED THE ASSISTANCE OF THE NYO. AS A RESULT, THE NYO 
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PLANS то INTERVIEW 
PHILADELPHIA, PA ON 1/28/93 WITHOUT PRIOR NOTICE. 


Po) 2H wir 
[ and IT IS THE HOPE OF 


THE NY OFFICE TO OBTAIN A STATEMENT FROM| | PRIOR vo HIS 
GRAND JURY APPEARANCE. INVESTIGATION AT NY DISCLOSED THAT ALL ar 
CURRENT EMPLOYEES AS WELL AS MOST FORMER EMPLOYEES OF WWF ARE 
BEING REPRESENTED BY WWF ATTORNEYXS AND IT IS BELIEVED THAT | 
5ден Prion Notice, 
[WOULD ALSO REQUEST WWF REPRESENTATION IF GONTACTED—EN 
ANX—OBHER-MANOR. 
[4 

NEW YORK HOPES TO SURPRISE| (Ат HIS RESIDEN® AND 
OBTAIN HIS COOPERATION IN THE INVESTIGATION WITHOUT WWF 
ATTORNEY INVOLVEMENT. 

NEW YORK HAS CHECKED PHILADELPHIA INDICES R| | 
WITH NEGATIVE RESULTS. 


NEW YORK CASE acent| и BE TRAVELING TO 


PHILADELPHIA DIVISION VIA GOVERNMENT CAR WITH U. S. ATTORNEY 


| INVESTIGATOR] | мо ASSISTANCE FROM THE PH 


| OFFICE IS ANTICIPATED. 
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Memorandum 


To : SAC DIV II (196B-NY-234993) (Р) Date 2/3/93 


me: в{ — — — —](c-12) 


Subject: 


DBA WORLD WRESTLING FEDERATION (WWF) b6 
STAMFORD, CONN b7C 
FRAUD BY MAIL; FRAUD BY WIRE 

OO:NY 


It is requested that a Sub A file be opened for above 
captioned case due to the fact that various documents were 
obtained from the Harrisburg, PA FBI and United States Attorney's 
Office. Specifically, FD-302'/s of various wrestling talent 
common to above investigation. In addition the U. S. Attorney's 
office furnished various Grand Jury material as well as 
transcripts of Lp erano Jury eral trial “dated June 
24-25, 1991 which took place in Harrisburg, PA. 


[  |was found guilty and is expected to testify in ^'^ 
the above captioned case. | 


New York will place Grand Jury and other material in 


bulky. 
— WEIL 
SERIALIZED 
3! FEB 0 3 1995 J 
1 ~ 196B-NY-234993 — NEW-YORK 
1 - Supv. C-12 
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zb 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 2/4/93 


wrestling 


United States Attorne 


| — Reviewed his 
(true name)| | — . j]|wrestling name) that the biggest problem 
was that the] ]were wrestling evenings at the 
time, 
by WWF standards. Concerning e compensation at Whr.| | 
stated that 


Б, а 
and | [advised that it wa mately , [ааһа 
that it was approximatel poseen in 1992. 


The 
following was obtained through observation and interview: 


Name: 
Date of Birth: 
Social Security 
Account Number: 
Marital Status: Married 


Current Residence: | 
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Date of transcription 2/ 4/ 93 


On January 28, 1993, Special agnt| | ë |] ыз 
accompanied ру tne-Eastern-pistriot of New York (EDNY) bé 
Investigator, ravelled to Philadelphia, 57 
Pennsylvania (PA). The purpose of this tri s ; 

Philadelphia, PA. 


U sa[ |] 


encountered 


who identified herself a 


ut expected to hear from him within the next few 
accepted service for both a 
and a document subpoena 


resent during this interview was 
— јо along with 
subpoenas for the EDNY. 
р" her telephone number as 


sister, 
were given copies of the 


4 
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by Datedictated 2/1/93 
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it and its contents are not to be distributed outside your agency. 


Memorandum 


To : SAC II (196B-NY-234993) (P) Date 3/22/93 


Worldwide Wrestling Federation, 
STAMFORD, CONNECTICUT; 

FBW; MF; 

OO: NY 


For information of_the SAC, on 1/4/93 $4———3] 
accompanied by Investigator nd AUSA 
travelled to th i ‚ PA. for a 
meeting with SA This meeting 
took place at the Harrisburg U.S. Attorney!s office. The purpose 
of the meeting was to obtain all of the Grand Jury testimony and 
302’s which led up to the Dr. ZAHORIAN trial and conviction in 
June, 1991. ъ7р 


It was learned at the meeting that i was a 
Cooperating Witness for the FBI in the case and 
consented to recording for consensually monitored conversations 


in making various steroid buys ron ice led to the 


trial and conviction of 


In addition to going over various facts of the trial 
and testimony by various witnesses, еш the 
various effects that steroids and steroid abuse have, as well as 
the new wonder drug of the WWF which is called Human Growth 
Hormones (HGH). жашын О that the HGH was developed to 
increase the growth of dwarf individuals and childre no 
longer produce the human growth hormone naturally. stated 
that the packet of vials that were sold for HGH to wrestlers and 
averaged between $400.00 to $500.00 from the legitimate I 
manufacturer, would sell for as much as $1,500.00 on the black 
market. Each HGH sequence requires a six week cycle to be 
effective. | 


C2- 196B-NY-234993 


1 — Supervisor, C-12 


WMF:jxs 


с со 


196B-NY-234993 


[ аауіѕеа tha ^ ^ Јаіа not cooperate with 
Harrisburg’s investigation. When questioned if would 
cooperate now[ ^  ]stated he had no idea р vou a 
three year sentence and was still incarcerated in Pennsylvania. 


stated that| — ]пеуег believed that any of 
the talent (wrestlers) of the WWF would ever testify against him 
since he was sort of a WWF buff. Following this meeting, AUSA 
then had the various requested Grand Jury et to SA and 


mmm and turned over the entire packet to S 


2* 
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WWF wrestler) 
.According to failed drug test for cocaine and: 
was recently suspended. 


— Т 
ccording to ааа О. С drug test for cocaine апа. 


observed him inject a steriod in the lockerroom. 


According t failed 
drug test for cocaine and was suspende So used Substitute 


en drug test was performed. On one occasion had to call 
and tell him that he. would fail test 
orgotten to bring clean urine to the arena. 


Requested interview in letter tol FF 2/18/93. 


F Wrestler) 
According to helf with lockerroom injection 
with steriods sometime in i990. 


we wrestler aka TTT 
teleph А k 


Interviewed b 


e e 


Memorandum 


To : SAC, II (196B-NY-234993) (P) Date 4/7/93 


рб 


WORLD WRESTLING FEDERATION 


On 4/6/93, captioned matter was discussed with AUSA 
Eastern District of New York. The purpose of the 

meeting was to identify the direction of the case and the extent 
of the fraud angle being developed. AUSA[ |адуізей that 
presently, he is not sure where the case is leading. There is a 
question regarding venue which has yet to be resolved. Venue 
could very well lie either in Federal Court in Boston, Mass. or 
in the local state courts in New York or in Massachusetts. 


| Further, he advised that at the present time, the case 
i is primarily focused on steroid abuse and the sexual exploitation 


He added that a determination should be made within the 
next few months as to the direction this сазе will take. 


RECOMMENDATION: That contact be maintained with AUSA 
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‘NEW YORK NEWSDAY, SUNDAY, MARCH 21, 1993 -. 
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You сай` own Larry Bird's Celtics j jersey. ‘The ALR. * 
"Society is holding its annual auction‘at the Plaza June . 
16 and Bird’s jersey, along with Andre-Agassi’s tennis . 
racquet, will be sold to benefit the National ‘Jewish 7; 

| Center for Immunology and Respiratory Medicine. `: 
3 Last year, a Phil Simms football Sent ‘for $ $1,000, but,- НИ 
еу, John McEnroe's smelly sneakers walked out бога: 44 
“шеге975. . . WARRIOR WOES: Poor Michael Ken- 


*a/month after he filed it: The. suit sought $7, million = ЧЕ 
“from the World Wrestling Federation for firing The: :| 5 
"Warrior without cause. The WWE. said itaji 
Or (real name Jamies Hellwig) for ster- 21.7 
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and had been 


SAC (196B-234993) (P) Date 4/14/93 


s[ |(с-2) 


dba 
World Wrestling Federation (WWF), 
STAMFORD, CONNECTICUT; 
FRAUD BY WIRE; 
FRAUD BY MAIL; 
OO:NY 


also 


testified on 4/1/93. 


It 


True Name: 
SSAN: 

Sex: 

Race: 
Height: 
Weight: 
Address: 


Telephone Number: 
True Name: 


Sex: 
Race: 


-> 
iere Z 
ee 


196B-NY-234993 


Hair: 
Weight: 

DOB: 

SSAN: 
Height: 
Citizenship: 
Address: 


Telephone Number: 
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- ON 
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Addresses 
Residence 


Business 


Former € 


*Date and place of marriage 
Cif applicable) 


Race Sex А Неї Hair. Eyes | 
а{е 56 
м) Female pic 


Birth date Birthplace 
Arrest Number Fingerprint classification Criminal specialty 


Social Security Number Drivers License Number 
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Specific information desired 
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Results of check 
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Birthplace 


Fingerprint classification Criminal specialty b6 
BHC 
. 24, 


Drivers License Number 


Specific information desired 


Сеи 


Results of check 


FB! — NEW YORK 


E m 


лыт HINQ DCIS 
letya FILE 15 TYPE 1 NAME SEARCH TO DCJS ¿AND NCIC: PUR/C ONLY 
SS N LOG/N 


‚МАМ .REx/W.RAc/U.nuB[ =a 
.SEINTCTUNE/*.HBY/*  .SQC/* .ЕБІ/ж . MNU 


.ALIASSH1/* b6 
.ALIASU2/* b7C 
~ALIASH#HS/% 

-ALTASH#47% 

.ALIAGHS/* 

. REQUESTOR? Š NAM : 

-COMMENTS/FRAUD BY WIRE 196B-NY-234993 . ч 


Ë 


Е 1024-1024 05/27/93 02699051 КЕВС6З 5804 ‘PART 001 OF 004 
NYSP HING КЕВС 
INPUT SEQUENCE NUMBER: 1623 HAS BEEN CORRECTED TO 16280 


N 1024-2 1024 05/27/93 02629062 KFBCE2805 PART .001 OF 001 . 
NYSP . PTST KEBC 1024 ; | - b6 


‚ NYFBINYOO ي‎ AE b7C 
‚О NAM Я Xn | | | 
` «DOB SEX/M. RAC/U | 


| CONFIRM RECORD: WITH ORIGINATOR à 


` MKE/WANTED PERSON 


ч, 


| VIN, VYR/Á 


ORI - NYG PD ZENTRAL WARRANTS ENTRY [|1|] 
МАМ _ SEX/M RAC/W ТОБ] |] 
81р /. Süc/. POBZ. 

‚ HGT НАТ] | SKN/. i 

| LERZPL 26501 LCT/M/OFF/5212 WEAPON OFFENSE-POSSESSION OF- (i) 6 
WST/1 ~ ACTEVE bic 
WTP/Z - BENCH WARRANT 
EXT/X- W .WEÓTEHESTER, ROCKLAND, NASSAU, SUFFOLK COUNTIES AND NYC 


RGV.  PFL/. N RSP/. 

pen condones DKT/4XO1814O0  DO0W/120484 
MIS/B x NM 

OLN/.  OLS/. | | 

LIC. LISZ/, INTZ. 


VMA/. VMO/. VST/. YCO/. 


. WPR/OSB314À 


Ë ap. 4 
"E Lol "ae e аа, а ` 
DH 054-104 Give Fa ODCIDWZT EPCS FART созі DE RO 


“YEP LE Ge кес 102 42 


UO NYÉBINYOU Е 

NA 

арға PEX Pt, BAG SU 

| LONFIR™ RECORD WITH GRIGINATOR 


` MEER/WANTED PERSON 
! DRI/NYOSZONO WARRANTS ENTRY 716-217-8236 


So 
uy КЕ 


SKN/. 
LCD/PL 22039 LC 55399 DANGEROUS DRUGS- | 
WS7/1 - ACTIVE 
WTP/2 ~ BENCH WARRAY 
EXT/Z- 
RCMZ. 


X 
WITHIN AND iQ va МЕМ YDRK STATE 


ЕРСИ. 


VIN/. VMO/, VST/. VCOFs. 
ARI/. ACA DOA/.  RES/. 
ИРВ/54858 > 


N 1024-1024 05/27/92 02629108 KFEC63807 PART 001 OF 001 
AGIC PTST KFBC 1024 
NYFBINYOO 


NO NCIC WANT poH Дай IBEK/M RAC/U 


N 1024-1024 05/27/93 02629116 KFBRCG3BO8 PART 001 OF 901 
NYIS HING КРЕС 1024 


KFEC16280 NO SUSPECTS š 


b7C 


b6 
bic 


5 


* Ф ° ` "m 
ON 1924-1024 05/27/95 GL GZ ug KFBCOGSIOU PART бей OF 0% 
NOLO. HIND КРЕС ; 
ACC Е 
NY CHEN AGO 


E 15 THE RESULT OF YOUR 
RUS ZC 


THIS Puget INTERSTATE LENT ICT INDEX RESEO 


OTHER SCARS -MARKS- 


Nu аш TATTOOS 


IDENTLFICATION DATA UPDATED 02/16/93 
THE CRIMINAL HISTORY RECORD IS MAINTAINED AND AVAILABLE FROM THE 
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16281 FILE 15 ТҮРЕ 4 RAP REQUEST NCIC III PUR/C = E & J 


<QRERATOR/ '  „LOG/KFBC. CONFIDENTIAL LOG/N 
TIRE. Rasra бет basee/ 11966- 


. МАМ ШЕ: 
PAI rp —1`519/* 

. ÀBENCY/* .BUILDING/* 
. ADDRESS /* | 

CITY-STATE/* .2ІР/ж 


. REQUESTOR’ 5 NAME 
.COMMENTS/FRAUD BY WIRE 196H-NY-234929: ” 


N 1025-1075 05/27/93 m. KFBC62810 PART 001 OF (— 


; NCIC HIQR КРЕС 
АБЁ . i ғ 
NYFBINYOO | 


THIS INTERSTATE IDENTIFICATION INDEX RESPONSE IS THE RESULT OF YOUR 
RECORD REQUEST FOR FBI[ — — — ]tzNDiVIDUAL'S RECORD WILL BE COMPLETE 


WHEN ALL RESPONSES ARE RECEI ЭМ THE FOLLOWING SOURCES: b7C 
FHI Бей E 
L uj | 


END | * 


, N 1025-1025 05/27/93 02622481 KFBC62811 PART 001 OF O01 
NCIC HIGR KFBC mE 
, АСК 
Î NYFBINYOO 
aty{ — | 


` THES RECORD IS BASED ONLY ON THE FBI NUMBER IN YOUR REQUEST] 
BECAUSE ADDITIONS OR DELETIONS MAY ВЕ MADE AT ANY TIME, A NEW БОРҮ 
SHQULD BE REQUESTER WHEN NEEDED FOR? SUBSEQUENT USE. | 
| ^. = FBI IDENTIFICATION RECORD ~ 


WHÉN EXPLANATION DF A CHARGE OR DISPOSITION IS NEEDED, COMMUNICATE b7C 
| DIRECTLY WITH THE AGENCY THAT FURNISHED THE DATA TO THE FBI. 


` МАМЕ . BI ` DATE REQUESTED I $ 
[ro [Г] 573278 x 

SEX RACE BIRTH DATE HEIGHT & EYES HAIR BIRTH PLACE 

w w ee] BR NITED STATES 

| ШЕШШ | | | | 


‚ Z-ARRESTED OR RECEIVED _ ] 


t 


ix "a 


a 


“J бу 
о 


1 
| $-ARRESTED OR -RECEIV 


| 
i 


\ 


| ADDITIDNAL CRIMINAL HISTORY RECORD INFORMATION IS MAINTAINED BY THE 


| FOLLOWING STATE(S): 
14 


Г 


ON 4035- 1025 05/27/92 0263 32627 КЕВБЁЗВ1? PART 001 OF еер 


` LETS KFBC А 
Z50738 CR — BAIIIO000 02195. NYFRINYOO O38065 07:30-07:30 05/27/93 sc 
TXT * us 
` HDRZ2LOiLKFBCOOB14089BH D. | эе : 
АТМ lary `. — š iot 1; 
' PART i | : 4 $ ' 
' THE. FOLLOWING RECORD PERTAING TO sbin LE 


GEORGIA ÉRIMINAL HISTORY 


| ` «TATE IDEN: BI- NER АРТ DATE 

" 08/27/93 _ 
B ) ` . : M П е | mM t . 

` SEX RACE- XE — HEYET SIGHT EYES HAIR ' SKIN HPLACE 10004 

Hos NW | BRO BRO ртс. 


SECURE. FINGERPRINT CLASS . НЕМЕ SCAR-MARK-TATTOO MISCELLANEOUS NER 


: ADDITIONAL IDENTIFIERS: > | " | 


** INTERSTATE IDENTIFTGATION. INDEX. + MULTISTATE OFFENDER жж ; 
* жзне каннын л KE tt шыны жж кк жы хе кк 


n H М ` М " , D N } 
ARREST-O2 ARREST DATE TRACKING NBR- : 


x 
{ 004 


ARREST-03 ARREST DATE TRACKING NBR- 


JUDICIAL” ` E 


E E 
* THIS RECORD IS. SOLELY. ЖОН OFFIGTAL CRIMINAL JUSTICE USE. ж 
* USE OF THIS RECORD. OR INFORMATION. HEREIN FOR ANY OTHER  * 
* PURPOSE VIOLATES GEORGIA LAW. * 
аы ыыы ыы ыыы KK о, 


үк" d + 
M ` oe oF 


' END OF RECORD +o eË 
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~ 


«+ 5 Date 5 | 24] 43 


C] Birth [] credit ЕЕ C] Death Lj 185 ГІ Marriage* ГІ Motor Vehicle ПІ other 


^ OPE / were. 


Return to File number 


S C-12 І4( 2-94. 274773 


Buded 


Б6 
BIE 
Addresses 
Residence 
Business 
Former 


*Date and place of marriage 
Cif applicable) 


Race 


r SEE 1 ` 


Birth data Birthplace b6 


Arrest Number Fingerprint classification Criminal specialty 


Social -= Number | Drivers License Number 


Specific information desired 


(cH 


Results of check 


JUN 0 2 7 


| d tur — NEW-YORK 


— N 1028-1028 05/27/93 02677 (ÍS9-kFBCeSS1S"PART 001 OF 
NYIS HING KFBC 1029 
KFBC16282 МО SUSPECTS 


М 1028-1028 05/27/93 02637895 КЕВС63816 PART 001 ОҒ 001 
NCIC HING KFBC 

ACK 

NYFBINYOO 


THIS NCIC INTERSTATE IDENTIFICATION INDEX ED lee THE RESULT OF YOUR 
C/U DOB PUR/C 


INGUIRY DATE 
05/27/93 


SEX RACE BIRTH DATE HEIGHT T EYES HAIR BIRTH PLACE 
M J aar ا سق‎ 


b er 


FINGERPRINT CLASS 


SCARS -МАКК =“ 
TATTOOS 5 AL SECURITY 


IDENTIFICATION DATA UPDATED 04/19/80 


THE CRIMINAL HISTORY RECORD IS MAINTAINED AND AVAILABLE FROM THE 
FOLLOWING: 


[Xl 


THE RECORD(S) CAN BE OBTAINED THROUGH THE INTERSTATE IDENTIFICATION 
INDEX BY USING THE APPROPRIATE NCIC TRANSACTION. 


END 


KFBG«HING DCJS и E 
16282 FILE 15 TYPE 1 NAME SEARCH TO DCJS (AND NCIC) PUR/C ONLY 


. OPER&TQR/ . LOG/KFBC. CONFIDENTIAL LOG/N-... 

. PUR/C..REASON/CRI. ORI/NYFBINYOO. CASE#/1196B- 
— . SEX/M. RAC/U. BDB: 

.ЅКІМ TONE/*. SU .S0C/* .FBI/* ҮТИМ 
.ALIAS#1/# Ë 

.ALIASE2/* 

.ALIASH3/* 

.ALIASÉ4/* 

.ALIASHS/* . 
.REBUESTOR'S NAME/ 

.COMMENTS/FRAUD BY WIRE 196B-NY-234993 Er 


N 1028-1028 05/27/93 02637589 KFBC63813 PART 001 OF 001 
NYSP PTST КЕНС 1029 
NYFBINYOU: - 


NO RECORD. - NYSPIN WANTED PERSONS FILE : ы 
NA b6 
.DOB SEX/M. RAG/U uer 


N 1028-1028 05/27/93 02637637 KFBC63814 PART ooi OF 001 : 
NCIC PTST KFBC 1029 
NYFBINYOO 


МО, NCIC WANT por. fam евим RAC/U . е 


KFBC HIQR NCIC ane -C 


! еу 
16283 FILE 15 TYPE 4 С} request NCIC III PUR/C Q É 
. QPERATOR/ .LOG/KFBOTCONFIDENTIAL LOG/N 

. PUR/C. REASON/CRI. ORI/NYFBINYOO.CASES/Ii96B- 

. МАМ 

.FBL SID/* 

SAGENCY/* . BUILDING/* 
.ADDRESS/* - А 

.CITY-STATE/* .ZIP/* 
. REQUESTOR’ S, NAME 

.COMMENTS/FRAUD BY WIRE 196B-NY-234993 . 


М 1029-1029 05/27/93 02639687 KFBC63817 PART 001 OF 001 

NCIC HIGR KFBC 

ACK 

NYFBINYOO 

THIS INTERSTATE IDENTIFICATION INDEX RESPONSE IS THE RESULT OF YOUR 
RECORD REQUEST FOR FBI[ sd]. THE FOLLOWING WILL RESPOND TO YOUR 
AGENCY: 


|| 


END - 


b6 
b7C 


Jawa — 


N 1029-1029 05/27/93 02639941 KFBC62818 PART 001 OF обі 
LETS KFBC . | 

90822 CR МЈІІІ0000 01994 NYFBINYOO 03148 07:34-07:34 05/27/93 | 
TXT. | 
HDR/2LO1LKFBCOOB822619BH 2 j 
АТМ | 

THIS RECORD IS BASED ON THE SID NUMBER IN YOUR REGUEST-SID | did 


NEW JERSEY CRIMINAL HISTORY DETAILED RECORD i 


| USE ОЕ THIS RECDRD IS GOVERNED BY FEDERAL AND STATE REGULATIONS. 
' UNLESS FINGERGERPRINTS ACCOMPANY YOUR INQUIRY, THE STATE BUREAU OF 
INDENTIFICATION CANNOT GUARANTEE THIS RECORD RELATES TO THE PERSON' IN 
WHOM YOU' HAVE AN INTEREST. USE OF THIS RECORD SHALL BE LIMITED SOLELY 
; TO THE AUTHORIZED PURPOSE FOR WHICH IT WAS GIVEN AND SHALL NOT BE 
‚ DISSEMINATED TO ANY UNAUTHORIZED PERSONS. THIS RECORD SHALL BE 
‚ DESTROYED AFTER IT HAS SERVED ITS INTENDED AND AUTHORIZED PURPOSE. 
ANY PERSON VIOLATING ‘FEDERAL OR STATE REGULATIONS GOVERNING ACCESS 
TO CRIMINAL HISTORY RECORD INFORMATION MAY BE SUBJECT TO CRIMINAL 
AND/OR CIVIL PENTALTIES. THIS RECORD IS CERTIFIED AS A TRUE COPY OF Š 
[^ THE CRIMINAL HISTORY RECORD: INFORMATION ON FILE FOR THE ASSIGNED STATE š i 
° IDENTIFICATION NUMBER. ` | 


STATE ID ND. FBI ND.[  —  ] DATE REQUESTED. 05/27/93 
МАМЕ: М” 


SEX .RACE BIRTH DATE “HEIGHT WEIGHT EYES HAIR BIRTH PLACE | 
M W ; 


RECEIVING: ` AGENCY; МҮЕВІМУОӘ. . - == LS. CITIZEN: Y “` UNE 


„ e we Я x ' ЕЗ + kg TAE se > < ` b b6 : 
FPC: 24TT10131417TTTT1209 AFIS ND: 656846 III: SINGLE STATE 


SOCIAL SECURITY NUMBERS 
SCARS/MARKS/TATTOOS/MISC NUMBERS 


e E E HE E E E E E E E HK E E E E EEE ее ARREST 001 EOE E E CC ELE E EEE EE CECE OE E E E E E GCE E C C EE EE 


ARRESTED AGENCY CASE NO: СС] 


ACC JEJE KE EK E TEETE EEE EET EEEE даа E3636 6303696263026 3636 KE EK EKE € EE EK JE ы 


DEPARTMENT OF CORRECTIONS DATA NOT FOUND FOR THIS SID NUMBER 
E. HE E HEHE KE EEE JEJE E EKER EKER OX E E E EEE HIER RIE TEE JI E EEE 0 0 4 


CRIMINAL HISTORY DIVERSION PROGRAM AND FELONY CONVICTION SUMMARY 


PRE-TRIAL INTERVENTION: 000 | 
CONDITIONAL ‘DISCHARGE: 000 

FELONY CONVICTIONS: 000 E 
VIOLATION OF PROBATION: -000 : 


CONTACT THE STATE BUREAU OF IDENTIFICATION (SBI) AT 609-882-2000, 
EXTENSION 2887 OR 2899, FOR MODIFICATIONS/QUESTIONS REQUARDING 
‘THIS RECORD., IF A DISPOSITION IS. ‘NEEDED, CONTACT THE AGENCY THAT 
FURNISHED THE DATA: TO THE SBI. 


Е " - END OF CCH RECORD 
END OF RECORD 
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FEDERAL BUREAU OF INVESTIGATION 


5/21/93 


Date of transcription 


Special Agent 


On May 17, 1993 
telephonically contacted residence 
telephone number The purpose of thi 


go over the facts concerning a communication between 
an attorney by the name G C] 
=== murine 


N as 
0 جو ا ا‎ 
occurred when was working for of the 

Typically, people would 


WORLDWIDE WRESTLING FEDERATION (WWF). 
of the talents, specifically, 


ould be hired by_the WWF to do 
E 
(phonetic) to work oh 


to 
and 


at WWF headquarters. 


4493 . ә 


% 


Investigation оп 5/17/93 at New York, Мем York File # 196B-2346259 


, (Telephonic) b6 
b7C 
by Date dictated 5/17/93 ^ — ^ — 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
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it and its contents аге not to be distributed outside your agency. 
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196B-234993 


Continuation of FD-302 | | -on__ 5/17/93 


, Page 


questioned as to 
whethe inued to esent afterl | 
solution, stated[ fhaa no idea what happened to the 
matter; that it suddenly went away. 


Since[ | by WF, there was a 
period of time when little co i i ing anything at 
the WWF was exchanged between 

11 f 


een 
concerning 
did not 


advised that he would not speak to the Government 
without a subpoena. Shortly thereafter[ left a word message 
en[ answering machine, that he in fact, had been 
subpoenae y the Government to testify in the Grand Jury. 
of that message left on the answering machine was that 


haracterized the meeting as "very grueling, 
almost cross-examining in nature". шашар {шишиши wat 
tried to confuse his testimony before the Grand Jury 


appearance, by cont going over various facts, which were 
not consistent with recollection of the events. It was at 


e would not have any part o 
o oth [Jana his Washington барыла. 
advised during this telephone conversation that the criminal 


who is a 


FD-302a (Rev. 11-15-83) ' ` x 


196B-234035 


Continuation ot FD-402 ot | | _ 5/17/93 „вае 3 


attorney from 


i d 
pod that they had in fa 


ct spoken several times 
but not about this issue. It was sealing that he was just 
being brushed off b answers. haracterized the 


- бу 


~d 
оо 


іп which he 


ео not кес 
e 
Кару үс recollection of n conversation. 


When questioned again, as to whether[ | in fact 
represented, at least preliminarily, in this matter, 
[5 Saia - аза not know, due to e fact that following 


those initial series of telephone calls the matter went away. 


T QO 


LIST OF WITNESSES WHO TESTIFIED BEFORE THE RY T 
IN THE TITAN SPORTS INVESTIGATION AS O wu 


Witness Date 


* crap 09 1993 


үлі — NEW YORK 


Memorandum 


To : SAC II (196-B-234993) ; »«[ | 
жаз sal ем) (ә 


Subject: 


< d 


dba WORLD WRESTLING FEDERATION (WWF) 
STAMFORD, CONNECTICUT i 
FRAUD by WIRE; MAIL FRAUD 

OO:NY 


Attached for the SAC is a alphabetical list of 
witnesses who testified before the Federal: Grand Jury in the b3 
above captioned investigation as of 


It should bé noted that this x | E 


1- SAC II 
1- SUP C-12 
@ 196 B-NY-234993 


JUL 09 1993 | 
EBI NEW YORK 


x © 
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КЫ 1 ЕЕ 
FEDERAL BUREAU ОЕ ІМУЕЅТІСАТІОМ 


Date of transcription 7/9/93 


On July 12, 1993 telephonically contacted 
Special Agent (SA) at the offices of the b3 


Assistant United States Attorne Eastern District of N b6 
'(EDNY). b7C 
urnished the following 


information: 


| [ _ ]statea that tron ————————— —] 

he was employed at the World Wrestling Federation, (WWF) as b3 
| of the WWF.| | | b6 
ме 


бу Go‏ ل 


| —— | who at the time was wrestling along wit 
|  . [for the WWF. [ _ btatea "yes" he recalled the 


onve 2 Lon neca оле rece eq n Qn oml o ë ne 
tt tet | 


|... A in addition to having to te 
[ lthat he could not be hired, had to teli Î 


| o  [-When questioned how| [knew 


that| | [had failed his WWF drug test, said at 
‘Special Agent (sa sould have to contac 


i 


Investigation on 7/12/93 at New York, New York File # 196B-NY-234993 RJ 
(TELEPHONICALLY) d 


by Date dictated 7/12/93 b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and'its contents are not to.be distributed outside your agency. 
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state that he currently owns a[. 1] 
and that he could be reached there at 
at any time. He always calls in a daily basis to 
Concerning his involvement with the WWF, 


get messages. 


To 


From : 


Subject: 


title. 


York (EDNY) has been investigating allegations of wrongdoin š 
. s ља | 
In November of 1552] | X 


cooperate in 


SAC, DIVISION II (196B-NY-234993) Date 7/16/93 


sq _ (с-і2) (P) wie 


CHANGED INTEROFFICE 


өз 


OON 


dba WORLD WRESTLING FEDERATION WWF; 

(TITAN SPORTS, INC.) 

STAMFORD, CONN f 

FRAUD BY WIRE; MAIL FRAUD, (STEROID ABUSE) «s; 
OO:NY 


Title is marked changed to include steroid abuse in 


For information of SAC, the Eastern District of New " 


ontacted the FBI and wanted to BIC 
Since November of 1992, C-12 | 


1s investigation. 


has been assisting the EDNY Grand Jury investigation. 


b3 


Summary of Grand Jury Investigations 


To date[ ]witnesses have testified before the Grand 


Jury regarding the above captioned RS The evidence 


developed indicates that TITAN an 
for conspiracy and distribution of steroids, T21 USC 846 and 331 b3 
(e). within the next 90 days. 


should be indicted 


b6 
ре b7C 


The Grand Jury continues to hear evidence on the two 


other areas ie: the sexual abuse issue and the fraud issue. 


CD- SAC, II (ауз-ну- 259443) 
1 


- SUPV. C-12 J14 -ny 73512293 


WMF:da 
(2) 
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RODEO amn 
کد‎ ۴۴0 Му 


JUL 2 1 1993 
FBI NEW YORK 


су qo Qo 
FD-36 (Rev. 11-17-88) ` 


FBI 

TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 

(J Teletype ГІ Immediate ГІ TOP SECRET 

Û Facsimile ПІ Priority Û] SECRET 
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Date 9/30/93 


DIRECTOR, ЕВТ 
(ATTN: BEHAVIORAL SCIENCE UNIT, 


ТВАТ UANTICO) 
ATTN: 


FROM ADIC, NEW YORK (196B-NY-234993) (P) 


supsect :[ — 1 1 Jaa 
WORLD WRESTLING FEDERATION (WWF) ; 
(TITAN SPORTS, INC.), 
STAMFORD, CT., 
FRAUD BY WIRE; MAIL FRAUD; 
° 00: NY 


Enclosed for the Behavioral Science Unit (BSU) is 
one copy of a TDK 1/2 video-tape entitlea[ ^ ]тАрЕ". 


. For information of the Bureau, the New York Office 
| (NYO) has been investigating allegations of wrongdoin 
TITAN SPORTS, INC. 
in November of 1992, 
contacted the FBI and wanted 
to cooperate in this investigation since November,1992, which 
has been pursued by the U. S. Attorney's Office for the EDNY. 


The allegations include distribution of steroids, 
sexual abuse of minors working on TITAN ring crews, and fraud 
on legitimate major suppliers of toys and vitamins. These 
suppliers were allegedly unaware that the majority of talent 
at the WWF who were promoting their products were steroid 


abusers. 
196 Brafv~ 23499? 3 — 
еа ышы — em —— 
New York Үш 


WMF:da Filed 
(3) i EA 
C 


Approved: Transmitted Per 
(Number) (Time) 


"US GO oO 
On 8/3/93, the U. S. Attorney’s Office acquired the b6 
1/2 inch video Ре entitled the Lin which is pic 
believed to show 


For information of BSU to date the NY investigation 
has identified t ictims of 


FNUL______]is shown in the tap 


but does not participate wit 
is shown while 
is wrestling wi To further identify 
ГГ  ]ne is the only on the tape. 

REOUEST OF BUREAU 


Review tape to determine if video is consistent 
with sexual abuse of minors. 
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Memorandum 


Date 
November 15, 1993 


Subject 
Request for Opinion from the FBI 
Behavioral Science Unit. 


b6 
Behavioral Science Unit Criminal Investigator 


FBI Academy Tel# (718) 330-7675 
Quantico, Va. 


The File #9201488 

(Titaln Sports, Inc. 

dba World Wrestling à f 
Federation (WWF 24 рз 


D ge wy 234493 AS 


NOV 19 1993 
FB) — NEW YORK 


United States Attorney 
Eastern District of New York 


United States Courthouse 
225 Cadman Plaza East 
Brooklyn, New York 11201 


November 18,'1993 


PRESS RELEASE 


- 


ZACHARY М. CARTER, United States Attorney for the 


Eastern 


istrict of New York, announced today the indictment of 
Vincent McMahon, Jr. and Titan Sports, Inc., doing business as 
the World |Wrestling Federation ("WWF"), for conspiring to 
distributelanabolic steroids and defraud the United States Food 
and Drug Administration, and for illegal possession of anabolic 
steroids with intent to distribute. 

According to the indictment, McMahon was the owner and 
chief executive officer of Titan and operated the WWF as an 
entertainment and sports business, presenting professional 
wrestling exhibitions throughout the United States. The 
indictment charges that from approximately 1985 until early in 
1991, McMahon and Titan, together with unindicted co-conspirator 
Dr. George Zahorian, III, and others, conspired to distribute 
anabolic steroids to WWF wrestling performers to enhance their 
size and nuscle development. Dr. Zahorian was arrested by the 
Federal Bureau of Investigation in February 1991 and in July 1991 
was convicted of violating federal law prohibiting.the.. ..... 
unauthorized distribution of anabolic steroids. RES LC 
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The indictment also alleges that in 1988 and 1989, 
McMahon caused Titan funds to be used to purchase steroids which 
were then distributed to a WWF performer. 

According: to today's indictment, at all relevant times 
anabolic steroids have been classified as prescription drugs 
under federal law and-could not be dispensed without a valid 
medical prescription. “In 1988, in response to increased 
incidents of illegal steroid distribution to athletes, Congress 
enacted legislation specifically prohibiting the possession with 
intent to distribute, and the distribution, of steroids for any 
purpose other than the treatment of disease in humans. The 
indictment announced today charges McMahon and Titan with 
violations of federal law both before and after the enactment of 
the 1988 statute. 

McMahon, who is 47 years old, lives at 47 Hurlingham 
Drive, in Greenwich, Connecticut. If convicted of the pending 
charges, he faces possible prison terms of five years on the 
conspiracy count and three years on the possession count, and 
fines up to $500,000. 

Titan Sports, Inc. is a Delaware corporation with its 
headquarters at 1241 East Main Street, in Stamford, Connecticut. 
If convicted of the pending charges, the corporation may be fined 
up to $500,000 per count. Additionally, in today's indictment 
the government seeks to forfeit Titan's corporate headquarters 


and all interests held by the defendants in that property. 
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Mr. Carter commended the Federal Bureau of 
Investigation for its assistance in the investigation that. 
preceded the charges announced today. The government's case vill 
be ‘prosecuted by Assistant United States Attorneys Sean F. O'Shea 


and James Orenstein. 
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UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 


es s ew OUO OU Uum. x‏ ست مہ ست حت جو سے سه Gu» өле әле өше re‏ کے eu»‏ سے 
UNITED STATES OF AMERICA INDICTMENT‏ 
against - Ср” ° 2 м 122-1226‏ - 
И Cr.‏ 

VINCENT K. McMAHON, JR. and (T. 18, U.S.C., SS 371 v. = 371 
TITAN SPORTS, INC., 2 and 3551, et еч. ; 

d/b/a "World Wrestling T. 21, U.S.C., 58 94948 

Federation," 333a, and 853) КИҢ 19 

Defendants. 

— y x 


THE GRAND JURY CHARGES; 
iNTRODUCTION TO ALL COUNTS 

1. From in or about 1984 until the date of the filing 
of this indictment, the defendant VINCENT K. McMAHON, JR. has 
been the Chief Executive Officer and sole owner of the defendant 
TITAN SPORTS, INC. (hereinafter "ТІТАМ"). 

2. At all times relevant to this indictment, TITAN, 
doing business as the "World Wrestling Federation" (hereinafter 
"WWF"), operated aAnentertainsent and sports business presenting 
professional wrestling exhibitions throughout the United States 
and around the world. WWF featured wrestling performers whose 
physiques veta characterized by unusually large and well-defined 
muscles. 

3. Тһе United States Food and Drug Administration 
(hereinafter "FDA") is the federal agency charged with the 
responsibility of protecting the health and safety of the 


American public by ensuring that drugs are safe and effective 
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before they may be manufactured and dispensed. FDA is also 
responsible for ensuring that approved drugs are manufactured and 
stored under conditions designed to promote their safety and 
effectiveness; that approved drugs are properly labeled to inform 
the public of medically approved usage; and that prescription 
drugs, because of their potential toxicity and harmful side 
effects, are distributed to individuals for use only when such 
use is supervised by a licensed medical practitioner acting 
within a legitimate doctor-patient relationship. 

4. Anabolic, androgenic Se dae {hereinafter 
"steroids") are chemical derivatives of testosterone, the male 
sex hormone. At all times relevant to this indictment, steroids, 
have been classified as prescription drugs by the FDA. I 

5. . Certain athletes and body-builders determined that 
steroids can increase muscle development and can enhance athletic 
performance and physical appearance. However, the FDA has not 
approved the use of steroids to enhance athletic performance or 
physical appearance. Because of the legal limitations on access 
to steroids, various other sources developed which circumvented 
the regulatory controls enforced by the FDA, principally unlawful 
and unregulated sales of steroids by unauthorized distributors 
and licensed ‘physicians who prescribed steroids for purposes 
other than the treatment of disease. 

6. In 1988, in response to increased incidents of 


illegal steroid distribution to athletes, Congress enacted 


legislation specifically prohibiting the possession with intent 


^ CO 
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< 


` 
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to distribute, ana the distribution of, steroids for any purpose 
other than the treatment of disease in humans. 

37. George T. Zahorian, III, named herein as an 
unindicted coconspirator, at all times relevant to this 
indictment was an osteopathic surgeon licensed in the state of 
Pennsylvania. Throughout the 1980s, Zahorian was assigned to 
attend WWF exhibitions in Pennsylvania by the Pennsylvania 
Athletic Commission.  Zahorian, with McMAHON's knowledge and 
approval, distributed steroids to wrestlers who performed at WWF- 
sponsored exhibitions. 

8. In 1989, the Pennsylvania Athletic Commission 
deregulated wrestling and no longer assigned Commission doctors 
to attend wrestling exhibitions, but only required the presence 
of a licensed physician to be paid by the promoter. Following 
this deregulation, in 1989 Zahorian appeared at a WWF exhibition 
and was paid by TITAN for his appearance. Later still in 1989, 
TITAN engaged Zahorian to be the attending doctor at another WWF 
exhibition to be held in Hershey, Pennsylvania. Before the event 
took place, however, TITAN officials, including McMAHON, learned 
of a federal investigation into Zahorian's activities, warned him 
of the investigation, and prevented him from appearing at that 


exhibition and any future WWF exhibition. 
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COUNT ONE 
(Conspiracy) 


9. Paragraphs 1 through 8 of this indictment are 


hereby realleged and.incorporated as if fully set forth herein. 


10. From in or about 1985 until in or about February 


1991, both dates being approximate and inclusive, within the 


Eastern District of New York and elsewhere, the defendants 


VINCENT K. McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World 


Wrestling Federation," together with others including George T. 


Zahorian, III, did knowingly and intentionally conspire to 


defraud the United States and to commit offenses against the 


United States, namely: 


a. to defraud the United States, in particular, 
the FDA, by impairing, impeding and defeating its 
efforts to regulate and control the manufacture and 
distribution of steroids within the United States, in 
violation of Title 18, United States Code, Section 371; 

b. to introduce and deliver for introduction 
into interstate commerce, with the intent to defraud 
and mislead, drugs that were misbranded within the 
meaning of Title 21, United States Code, Section 353 (b) 
in that the drugs were prescription drugs distributed 
without a prescription, in violation of Title 21, 
United States Code, Sections 331(а) and 333(a) (2) 
(formerly Title 21, United States Code, Section 


333(b)); 


CO СЭ 
5 
с. to cause, with intent to defraud апа mislead, 
the misbranding of drugs within the meaning of Title 

21, United States Code, Section 353(b) while such drugs 

were being held for sale, in that the drugs were 

prescription drugs distributed without а prescription, 
in violation of Title 21, United States Code, Sections 

331(k) and 333(a)(2) (formerly Title 21, United States 

Code, Section 333(b)); and 

d. to knowingly distribute and possess with 
intent to distribute steroids for’ use in humans other 
than the treatment of a disease pursuant to the order 
of a physician, in violation of Title 21, United States 

Code, Section 333(e)(1). 

11. An object of the conspiracy was unlawfully to 
provide WWF wrestling performers with steroids to enhance their 
size and musculature, and thereby to increase the ticket sales 
for WWF exhibitions and the profits to TITAN and McMAHON. 

12. In furtherance of the conspiracy and to effect the . 
objects thereof, within the Eastern District of New York and 
elsewhere, the defendants TITAN and McMAHON апа others committed 


the following: А 
OVERT ACTS 
а. On several occasions in or about and between 
1985 and February 1991, Zahorian ordered, paid for and received 
shipments of steroids, including but not limited to Nandrolone 


Decanoate (commonly known as "Deca") from a pharmaceutical 


ume CO cS 


company located in Westbury and Rockville Centre, Long Island, 


New York. 
b. On several occasions in or about and between 


1985 and February 1991, Zahorian distributed steroids to WWF 


< 


wrestling performers at exhibitions and via express delivery 
shipments. 
c. On several occasions in or about and between 
1985 and February 1991, TITAN presented wrestling exhibitions at 
the Nassau Veterans Memorial Coliseum in Uniondale, Long Island, 
New: York. 
d. On several occasions in or about and between 
March 1988 and October 1989, McMAHON ordered and caused to be i 
‘ordered Nandrolone Decanoate from Zahorian. | 
е. On several occasions in or about and between 
March 1988 and October 1989, to evade. the detection of these * 
transactions, McMAHON utilized TITAN funds or resources to cause 
the purchase of bank checks used to pay Zahorian for shipments of 
Nandrolone Decanoate. 
f. On several occasions in or about and between 
March 1988 and October 1989, McMAHON distributed and caused to be 
distributed Nandrolone Decanoate to a WWF performer known to the 
Grand Jury. I 
g. During the period from in or about August e 


1989 to in or about November 1989, TITAN executives instructed an 


employee of TITAN known to the Grand Jury to hire Zahorian as the 


attending doctor at a WWF exhibition to be held in Hershey, 
Pennsylvania in December 1989. 

h. On or about December 1, 1989, a TITAN 
executive known to the Grand Jury sent a memorandum to another 
TITAN executive known to the Grand Jury discussing the fact that 
Zahorian was under investigation and instructing the executive 
(i) to ensure that Zahorian did not attend an upcoming TITAN 
exhibition and (ii) to consider warning Zahorian of the existence 
of the investigation. 

i. In or about December 1989, McMAHON and a 
TITAN executive known to the Grand Jury discussed informing 
Zahorian that he was under investigation by law enforcement 
authorities. 

js In or about December 1989, a TITAN executive 
known to the Grand Jury had a telephone conversation with 
Zahorian and directed him to destroy any records of Zahorian's 
contact with WWF or WWF wrestling personnel. 

k. In or about March 1990, McMAHON had a 
conversation with a WWF performer known to the Grand Jury. 

1% Оп or about January 25, 1991, МСМАНОМ 


к 


instructed all WWF wrestlers using stéroids to carry а 


prescription.for such steroids at all times. 


(Title 18, United States Code, Sections 371 and 3551 et 


seq.). 
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COUNT TWO 
(Possession With Intent To Distribute Anabolic Steroids) 


13. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 

14. Оп or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendant TITAN SPORTS, 
INC., d/b/a “World Wrestling Federation," together with others 
including George T. Zahorian, III, did knowingly and 
intentionally possess with intent to distribute to Vincent K. 
McMahon, Jr. a substance containing anabolic steroids for use in 
humans other than for the treatment of disease pursuant to the 
order of a physician. pra 

(Title 18, United States Code, Sections 2 and 3551 et 


seg.; Title 21, United States Code, Section 333(e)(1)). 


s 


f COUNT THREE | 
(Possession With Intent To Distribute Anabolic Steroids) 


15. Paragraphs 1 through 8 of this indictment аге 
hereby realleged and incorporated as if fully set forth herein. 

16. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendants VINCENT K. 
McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World Wrestling. | 
Federation," together with others including George T; Zahorian, 
III, did knowingly and intentionally possess with intent to 


distribute to a WWF performer known to the Grand Jury a substance 


9 
containing anabolic steroids for use in humans other than for the 
treatment of disease pursuant to the order of a physician. 

(Title 18, United States Code, Sections 2 and 3551 et 
seq.; Title 21, United States Code, Section 333(e)(1)). 
COUNT FOUR 
a ы (Forfeiture) 
17. Paragraphs 1 through 16 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
18. In committing one or both of the felony offenses 
alleged in Counts Two and Three of this indictment, each of which 
is punishable by imprisonment for more than one year, the 
defendants VINCENT K. McMAHON, JR. and TITAN SPORTS, INC., d/b/a 
"World Wrestling Federation," used, or intended to use, the 
property described below to comnit or facilitate the said 
violations of Title 21, United States Code, Section 333(e)(1): 
All that lot or parcel of land, together with its 
buildings, improvements, fixtures, attachments and 
easements, located at 1241 East Main Street, Stamford 
Connecticut; being the premises situated in the City of 
Stamford, County of Fairfield, and State of 
Connecticut, shown on a certain map entitled, "Map 
Showing.Property Surveyed For Stephen Gulick, Jr. & 
‘Richard A. Engelke Stamford, Ct." dated 27 Nov. 1979 by 
Raymond L. Redniss #10046, which map is on file in the 


office of the Town Clerk of Stanford as Map No. 10447. 
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19. By virtue of the commission of one or both of the 


felony offenses alleged in Counts Two and Three of this 


indictment by the defendants VINCENT K. McMAHON, JR. and TITAN 


SPORTS, INC., d/b/a "World Wrestling Federation," any and all 


2 interests each defendant has in the above-described property is 


, vested in the United States. 


20. Іп the event that any property, real or personal, 


involved in the offenses described in this indictment or any 


property traceable to such property, as a result of any act or 


omission of the defendant VINCENT K. McMAHON, JR. or the 


defendant TITAN SPORTS, INC., d/b/a "World Wrestling Federation": 


as reme um ж s. — on A —— n ا‎ 


(1) cannot be located upon exercise of due 
diligence; 

(2) has been transferred, sold to, or deposited 
with, a third party; ` 

(3) has been placed beyond the jurisdiction of 
the court; . ^ 

(4) has been substantially dininished in value; 
or 

(5) has been commingled with other property which 


cannot be divided without difficulty, 


ms Т 77 — s a میت م‎ men P ла == -- 
= MAEM < s On тч нки мыш т быс" утты сът. э = oe --.. eman ewe» 
" z 


, —s —— F í -- tee 


++ 


| Oo с 


11 
the forfeiture of апу other property of the defendants, wp to the 


value of the property described above in Paragraph 38, is 
demanded to be forfeited to the United States. 
(Title 21, United States Code, Sections 333a and 853). 
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ies allegations. 
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.honcho Vince .McMahon: immediately 


dented the allegations. 


Тиеп Sports, which does business as the WWF, 
and McMahon allegedly “conspired to distribute 
anabolic steroids to WWF wrestling performers to 
enhance thelr size and muscle development" be- 

“tween 1985 and 1991, Brooklyn U.S. Attorney Za- 


chary Carter sald. 


The indictment also charges McMahon, 47, and Titan 
with illegal possession of steroids with intent to distrib- 
ute. The money McMahon allegedly used to buy the 


CM . Sy KYLE SMITH 


The operator of the World Wrestling Fed- 
eration was indicted yesterday on charges 
tonspiring to beef up his brawny brawl- 
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steroids came out of Titan funds, the indictment 


charged. 

McMahon faces up to five 
years‘In prison If convicted of 
conspirscy, and up to three 
years If convicted of possession, 
as well as fines of up to $500,000, 
Carter sald. 

McMahon owns Titan, which 
matkets wrestling tie-ins. The 
conipany faces fines of up to 
$1 million, if convicted on both 
counts, Carter said. Prosecutors 
also want to seize Titan's corpo- 
rate headquarters in Stamford, 

nn.,« 

McMahon? admitted that he 
used steroids “four or five years 
арол ый denied that he did so 
Hlegally. К 

“То turn my personal life into а 
Crime, (the prosecutors) claim 
that I shared some of those ster- 
olds with a friend, and that 
somehow made me a dealer," 
said McMahon, who lives in 
Greenwich, Conn. 


Sterolds are prescription drugs 
that cannot legally bc used to en- 
hance athletic performance or 
physical appearance.. 

The indictment names Dr. 
George Zahorlan III — who was 
convicted in 1991 of distributing 
steroids — as an unindicted co- 
conspirator. 

Zahorlan was employed by 
"Titan as an attending doctor for 
WWF exhibitions before 
McMahon learned of the federal 
Investigation of the doctor, the 
indictment said. 

McMahon sald the conspiracy 
rap was simply an attempt to 
“make me responsible for what 
the doctor did." 

"Ididnosuchthing", . 

No wrestlers are named in the 
indictment. e 

Prosecutors would not say 
whether wrestlers would be 
charged. 


"To turn my personal 
life into a crime, [the 
prosecutors] claim that 1 
shared some of those 
steroids with a friend, 
and that somehow 
made me a dealer." 
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VINCE McMAHON 


During his trial, Zahorlan testi. 
fled that between November 1988 
and March 1990, he sold steroids 

"to McMahon and to many pro 
wrestlers, Including two of the 
federation's then-top drawing 
cards, Hulk Hogan and Rowdy 
Roddy Piper. i 


Post sports columnist Phil - 
Mushnick investigated sterold ` 


use among professional wres- 
tlers іп а serles of exposes in 1991 
and 1992. 5 

Prosecutors had по comment 
on whether Mushnick's report- 
ing Inspired the 0.5. attorney's 
Investigation. H 

The WWF began steroid testing 


of Из wrestlers In 1991 —- 


“largely because of Phil Mush- 


nick," sald Dave Metzler, the ебі. 


tor &nd publisher of Wrestling 
* Observer Newsletter. 

Steroid use In the WWF was 
rampant before then, but has 
since become rare, Metzler saíd. 
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WRESTLE MANIAC: Former World Wrestling Federation 
heavyweight champion Hulk Hogan. 


- 


ж 
$5 
; EN 


. i By CATHY BURKE 


The.. World Wrestling 
Federation has’ grown 
faster than a sweaty pair 
of sterold-pumped pecs. 


And experts say even its 
legal, woes may not be 
enough to pin the muscle- 
bound company tothe mat. 


"The only thing that 
would put them out of busi. 
ness Is if television stopped 
alring their shows," said 
David Meltzer, who writes 
the ll-year-old Wrestling 
Observer Newsletter. 


“The WWF із bullt on 


television. And it's a big 

iness” 

In 1982, the WWF, owned 
by Titan Sports Inc. of 

, Stamford, Conn, was a re- 
gional wrestling organiza. 
tion that presented 200 live 
events a year, and had 79 
affiliated television sta» 
tions, 

_Meltzer says it since has 
grown by leaps and 
bounds. 

The privately held сот: 
pany wouldn't answer 
questions yesterday about 
its current holdings. 

But Meltzer says it's a 
good guess that the WWF 


Only a TV piledriver coul 


takes In “well in excess” of 
$100 million a year. 

It's into everything from 
live events, ta TV, to cable, 
to music albums to pro- 
gram filers to action fig- 
ures for the kids. 

Its shows are seen, аз 
well, in more than two 
dozen forelgn countries, he 
sald. 

“Right now, the WWF Is 
bigger in England and 
Germany than it is here,” 
“Meltzer said. 

By far, however, the big- 
gest chunks of the WWF's 
money comes from its live 


shows: WWF Superstars, 


Meltzer said. Meadowlands — as well as 
“That's why television is -the Spectrum in Philadel: WWF Challenge, ‘and 
во crucial" hé sald. Xou phla and the Pittsburgh WWF Spotlight. 
can't pump up your show Civic Arena. 
you have no television to - 8 At every live event, ihe On Ahe USA Network, 
promote It." there'll be enough merch» "Monday Night Raw," 
According to Meltzer: andise to rival any rock WWF all-American Wres- 


Ш WWF heros and vill. 
lains like Lex Lugor, Bret 


star gig: Souvenir pro- 
grams, T-shirts, posters 


tling on Sunday mornings 
&nd WWF Manía on Satur- 


Hart, the Undertaker. and action figures. 
Macho Man Randy Savage Ш The WWF also has a “ay mornings: 
and Yokozuma can packin fan club that once boasted R In 1985, the WWF's first 


between 3,000 and 4,000 
fans per live event. 

W The biggest audiences 
come from the three New 
*York-area arenas — Nas- 
sau Coliseum, Madison 


а membership іп the tens 
of thousands worldwide. 
Then, Meltzer said, 
there's TV — and music, 
WM The WWE has between 
200 and 230 affillated, sta., 


shows and merchandising, | Square“ Garden хава; the ; ` tions, and syndicates three 
- a a: ка = * P^ t4 bi . * © ж. 
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entry in the music worid, 
“The Wrestling Album,” 
went gold. Two years later, 
“Piledriver — The Wres- 
tling Album И,” spent 20 
,wecks, .on the Billboard, 
баз. або, „рты 
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turning glitzy, fake vio- 
Лепсе into a $500 muon А 
,.w, industry. js. 
` s Vince:MeMalon, the... ‘McMahon acknowlédged : 
‘| “Пгеріше boss of the World -. using steroids himself and ; 
> Wrestling Federation, and .sharing some.with a wres- 
.. his pumped-up;.multi-mil- „tler, friend, but scoffed at. 
‘lion-dollar empire were, theclaim that he broke the.’ 
НЕ ‘charged yesterday ina law, To turn my personal. E 
federal indictment with il- ^ .use sinto a crime; they * 
legally dispensing muscle: claim that I shared’ some 
enhancing steroids. .- ` , of those steroids, with a* 
“ The four-count indict-, " friend, and that somehow ; 
:ment charged that McMa- -, made me a dealer.” 
. hon, 47; and Titan-Sports.. Jerry McDevitt, McMa- | 
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physician: or 39910 sëlling: х 


Ë tergids t to еа rez} rend E 
Ез «The HAIGHT HALES that bes: 
tween. March; 2988 and: October’ 1989,.., 
McMahon, “repeatedly, ordered:ste-; , 
roids” from Zahorian and.hid:the. < 


Etransaction by using: Titan funds. +; fie 


5. > „The feds charge that after WWE. dis- 
peovered -Zahoriári: was ander. investi- ` 
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Ес Parlers "jn 51989; MCMAHON. and 4 an 
Bünnanipd: Titan-executive discussed: 
{warning :Záhoriam:herwas:under-in- 
-pvestigation, the feds Charge... зитор 
ет Жал : Аус Ve eds n T y s, 


“The FBI arrested: Záhoriani in Бере“ 


к 
x 


pruary: :1991: and “four “months later: Te 


Inc. WWF's parent compa-, hon's attorney, called ihe' |-e 
ny, gave steroids, a deriva- indictment “cockamamie” 
tive of male testosterone, and said: “We're going | 3 
to an 'unnamed тсе back шо, ancient ЫМ К, 18 et ӨШ 
between 1985 and early sionist history: to fashion. | 
|-1991. > an indictment against Vin- | = : 22222 D" 
. Тһе charges, could body cent McMahon.” The case |85 опапу: ‘used Stéróids bou bt fr рег-” 
slam McMahon -- the тап links McMahon and Titan | З .horian;and-announced 6 to om Za- 
‚ who brought Hulk Hogan to George Zahorian оѓ | Z iifidependenttestin f ugh new- 
-- and a whole generation of Pennsylvania, a former. | zs, syréstle E or;all WWF 
üitary-ease a&tors, to WWF {Фо o Ux ma ya Seis. 
Sand loca]iarena; 2% e WWF Page 44 . әз The pM ИЕГЕ Чо seize Ti- 
— өс tan's $9 million «Corporate E. 
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A ters i in Stamford; Conn. 2 


*"MeMahon faces t up. S to eight y years isi 
jail while - Titan апа. "McMahon, of 
‘Greenwich; ;Conn.; could, each pay 
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* $500,000 fin ires per count.-. mtt = 
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4 Brooklyn. `D. S “Attorney: Zachary W.. 
"Carter. said his'office had | jurisdiction ~ 
-becáüse-some of the: illegal. distribu- 
-tion took place during wrestling cards 
at the Nassau Veterans Memorial Col- 
‘iseum on Long Island.:: ад ay 
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MEMO nd hi: UE andis ДЗ McMahon 
on “Ап 50] ly e et dol құты 
i ‘pany, Titan DM ү, a Six кеч Ei the to wrestling Bers fz 
: “year conspiracy to distribute’ steroids seformers ‘around the , Country. ;No,wresz 2 
< WWE wrestlers “to enharice.their, size .. КС) ers were named in ‘the indictment: A 
**ánd muscle’ development” z^ E 329 24535 Кыр > McMahon, ; 47; faces р prison i terms of up x 
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I statemenit;isaid:the* "oo. 5 years on: thé | conspiracy charge and J 
` charges were based o on an adráission: thats eu) t0 З years;on'a charge of: possession = 
‘che had used steroids years ago'when they z ‘with intent to distribute steriods апа up S 
"were egal. “Toturh my personal usé into 510: $500, 000 i in. fines. Titan, with; -head- 2: 
а crime, ‘they, [prosecutors] claim:that.Izs rS “quarters inzStamford;: Conn „could: berz 
"shared some of thosé 'steroids:v Наз filed up to ) $1.5, millions; 2% er. sere 
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W: WE. в МсМаһоп Indicted = 


: Vince McMahon, the wrestling impresatio; and his World Wrestling . 
21 Federation have been indicted in Brooklyn on Federal charges that they - 
~{ conspired for years with a convicted steroid dealer to distribute anabolic 
Steroide to W.W.F. wrestlers. . . 

. The primary case against McMahon was 'apparentiy developed with: ^ 
the cooperation of Dr. George Zahorian 3d, a Pennsylvania physician .., 
who'was listed in the indictment as an " unindicted co-conspirator., 
Zahorian was convicted of steroid distribution ín 1991 after a Federal 
trial in Pennsylvania, in which he testified that he had supplied steroids 

‘| to Hulk Hogan and other W.W.F wrestlers. ” 
In a statement issued through his lawyers, McMahon sald the 
prosecutors “аге now trying to make me responsible for what the doctor. 
did. I did no such thing." 

“On a separate charge of possession with Intent to distribute steroids 
to a W.W.F. performer In October 1989, McMahon, who had previously 
acknowledged having used steroids before simple possession became a 
Federal crime in 1991, said the prosecutors, “claim that I shared some > 
of those steroids with a friend and that somehow made me a dealer." 
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By DOUGLAS KENNEDY 

World Wrestling Federa- 

MS. -honcho Vinée- 

к: Маһоо | yesterday 
ded not 


‘ascle-building 
^ to his hulking brawlers, 
The WWF boss, who 
promoted mega-muscle- 


‚ Wrestlers, was released on 
-an unsecured $250,000 bond 
` at his arraignment in fed- 
` eral court in Uniondale, 


EJ 


.am.going.to wait to say it. 


outside the courthouse. 

McMahon, 47, of Green- 
wich, Conn, is charged 
with conspiracy and distri- 
'bution of anabolic steroids 
.to WWF wrestlers between 
1985 and 1991. 

The government соп- 
` tends that McMahon used 
the funds of Titan Sports 
Inc; which ‘oversees the 
WWF, to purchase the. 
Steroids. Prosecutors want 
“to seize Titan's $9 million 
corporate headquarters in. 
Stamford, Conn. - -- - 


guilty to: r—— 
Charges of distributing ' 
Р steroids ' 


man Hulk Hogan and other* 


“I-have a lot to say, but I | 


in court," he told reporters. |: 


e 


(Mount Clipping in Space Below) 


VINCE McMAHON 
PU tell the judge. 


McMahon, who has 
denied the. charges, says 
һе onée "shared steroids 
with & friend" when they 
were legal: ` 


In 1991, Dr. George Zaho-- 


rian, а WWF physician, 
was convicted of selling 
Steroids to four profes- 
„sional wrestlers, ‘and, а 
weight, lifter, 

`Zahorian, who has testi- 
fied that he sold steroids to 


on a ERES s a 


MeMahon pleads not guilty 
io steroid charges ; 


„McMahon mused: 


(indicate page, name of 
newspaper, city and state.) 


Mod 24,153 
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МеМаһоп,, Hulk Hogan * 1 
“қапа .others ‘between: 1988 * 
and, 1990, .is-named in ths. 
current suit ds: а. co-éort- 
.Spirator. - D 

McMahon has clainici^ 
that the charges- against > 
^im are based on геһазһейзз | 
material from the Zahoz гі 
rian case. =з 

Assistant “U.S. Attorney: od 
Sean O'Shea: denied. that" | 
yesterday, and said "alli 
would become clear"iwhen:: y] 
the McMahon.case goés to a ij 
trial іт Мау. n 

‘McMahon, who is outra>( | 


geously outspoken’ at: 3) 
times, was unusually sub-ià.f 
dued yesterday. . 111 


Dressed in а navy-blue.-Jj; 
double-breasted suit' that’) 
showed off his well-de:: i3 | 
veloped ^ upper body, гт. 

а 


р 


“Sometimes life is unfair. 
Unfortunately for me, this 
is one of those instances”; £, 
He faces up to еһе! 
years in jail and a $500,000 
fine, if convicted. 
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Hulk Hógàn; tan and 
‘brawny star of ring: and sil- 
sever Screen; is smack: inthe 
Iniddle’: -of the, federal 156: 
roid’. ‘charges ‘against "World: 
Wrestling Federatión-Pre$i- 
dent 'Vince-MéMahon, thë. 
Daily. News has learned. , 
. McMahon yesterday 
pleaded: innocent-in Union 7 
БЕЛГЕ Д Federal iCouPt-to” 
several’ ‘charges, including. 
Í illegally: distributing: ste-- 
roids:to-àn: 'unname vřes: 


and,Octobér1989 ^. 
| That wrestler was ‘identi 
i Пеа as’ Hogan by M Máhon's: 
D iformer’ driver; James шаг: 
hrougli: his attorney, rank 
Riccio, "Stuart. yesterqày- - 
. told The "News that. MeN 
: hon once ordered hinî to d 
i liver’a shipment of:steroids 

j to-Hogan, ` LN 

| +. “(Stuartiswas.tóldiby:Me-- 


` 


? ‘Mahon’to"pick:up some pre-. 
seriptions, he might. have 
gone to thé doctor first; and: 

у scriptions to: Haie. Новапу” 

, Riccio said: 

Не «said che: ‘believed: ithe’ 


(Mount Clipping in Space Below) 


vres=-- 
„Мег. between March. 1988. 


Nwrongdóing, and: after’ his..- 


Шет: ће", г. took:.the--pre: - 


(Indicate раде, пате of 
: newspaper, city and state.) 
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` incident , occurred; in 4988. 
“Не; said: he. “understood that 
Hogan ‘cooperated: with; the 
“Brooklyn! federal grand jury - 
that. indicted: McMahon last 
week, - 

Late yésterday, Hogan' 5. 
attomney,. "Henry; .Holmes.,of 
“Los, Angeles, declined: to: 
comment on: Stuart’s ‘allega- 

ns. E ж 
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‚ШП 1991; rere “blond. idol. 
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E movie “Мг; Nanny? 
,admitted..to "using; steroids: 
three, times as part of ia 
medical, rehabilitation; ipro. ck 
Bram., ‚Не, never. directly:i іше 
plicated’ McMahon. ONLY 


1MeMation. has: admitted» : : 
-using steroids and; :after!hisi 
. tiridictment.last week; he ac- 
knowledged sharing: them:- 
'with.an:unnamed syréstling: = 
*'friend:!! He: shasvdenied’ à 


appearance. before:Federati 
Judge: Jacob-Mishler-yester- 
day he Attributedchis (гоц 
bles to bad luck: 


“Sometimes life is: np. 
‚апа: ‘unfortunately, for: m 
this"i$ oie of" ihose in: { 
statices,” Said меМаһдп., 
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` LEGAL TUSSLE: Vince McMahon (center) jeaves federal court rin, 
Uniondale, L.If; yesterday, where, he pleaded innocent to conspiracy, < 
and distributing : steroids. ; МК E НОРА DAKHSHANDAGI 1 
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WORLD WRESTLING FEDERATION (WWF); FBW; MAIL FRAUD; STEROID 
DISTRIBUTION; OO:NY. | 

FOR INFORMATION OF THE BUREAU, ON 11/18/93 А FEDERAL 
GRAND JURY IN THE EASTERN DISTRICT OF NEW YORK (EDNY) RETURNED 
A TRUE BILL ON| | AND TITAN SPORTS, INC. 
DOING BUSINESS AS THE "WORLD WRESTLING FEDERATION, INC." ON 
ONE COUNT OF CONSPIRACY TO DISTRIBUTE ANABOLIC STEROIDS (TITLE 
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333(E) (1), AND ONE COUNT OF FORFEITURE UNDER TITLE 21, USC, 
SECTIONS 333A AND 853. 

THE INDICTMENT CHARGES твт| anp TITAN SPORTS, 
TOGETHER WITH OTHERS INCLUDING UNINDICTED co-consPIRATOR| | 


(| [oons ТО DISTRIBUTE ANABOLIC STEROIDS 


FROM APPROXIMATELY 1985 UNTIL EARLY 1991. TN PARTICULAR, THE 
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IN FEBRUARY, 1991, DR. ZAHORIAN WAS ARRESTED BY “FBI 


AGENTS FOLLOWING. HIS CONVICTION AT A JUNE 1991 TRIAL AND WAS 


SENTENCED TO PRISON. 
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APAGE 3 NEW YORK 196B-NY-226621 UNCLAS 
NY HAS PLACED ovER| | WITNESSES BEFORE THE EDNY GRAND 
JURY IncLupInc[ si us 
EDNY ATTORNEYS HAVE STATED THAT THEY WILL CONTINUE TO 
PRESS THE FRAUD ANGLE OF THE CASE. 
Г] EXPECTED TO SURRENDER TO NY FBI AGENTS ОМ 


r 
11/22/93 FOR PROCESSING. 


b7C 
IF CONVICTED, ИШИН A PRISON TERM OF 5 YEARS AND 

A POSSIBLE $250,000 FINE FOR EACH COUNT. IF THE CORPORATION 

IS CONVICTED, IT MAY BE FINED UP TO $500,000 PER COUNT AS WELL 

AS BEING FORFEITED TO THE U.S. GOVERNMENT. 
NY WILL CONTINUE TO UPDATE THE BUREAU ON ITS ONGOING 

INVESTIGATION AS NEW DEVELOPMENTS ARISE. 
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b 


WORLD WRESTLING FEDERATION (WWF); FEW: MAIL FRAUD; STEROID 


- С\ 


DISTRIEJTION; OGO:NY. 


FOR INFORMATION OF THE BUREAU, ON 11/18/93 A FEDERAL 


GRAND JURY IN. THE EASTERN DISTRICT GF NEW УСАК (EDNY) RETURNED 


T ві -—— TITAN SPORTS, INC- | 


DOING BUSINESS AS THE "МОК WRESTLING FEDERATION, INC," DN 


SNE COUNT OF CONSPIRACY ТО. DISTRIBUTE ANABOLIC STEROIDS (TITLE 


= 


18, USC, SECTION 371), TWO (2) COUNTS GF POESESSION WITH a 


m" 
196% ny- 234993 AK 


Searched —— 
Ў ‘Serialized 
. Indexed i : : 

Filed .. 


» 


PAGE TWO DE FBiNY.O023 UNCLAS 
INTENT Та DISTRIBUTE ANABOLIC STERGIDS TITLE 21, USS, SECTIGN 
3334E) (12, AND ONE COUNT OF FORFEITURE UNDER TITLE 21, 952, 
SECTIONS 3334 AND oss, р 
Sy THE INDIGTMENT CHARGES тнат[ Jews TITAN SPORTS, 
TOGETHER WITH QTHERS INCLUDING UNINDICTED CO-CONSPIRATORT | 


[ C o |coNspIREb то DISTRIBUTE ANABOLIC STEROIDS 


` FROM APPROX IMATELY 1985 UNTIL EARLY 1991. IN. PARTICULAR, THE 


INDICTMENT SHARGES THAT 


| THE INDICTMENT ALSO SPECIFICALLY HARGER, THE 
| DEFENDANT IN CONNECTION WITH ONE OF THOSE SHIPMENTS ûf | 
STEROIDS d s s: £989 AND FURTHER SEEKS THÉ FÜRFEITURE оғ 
, TITANS CORPORATE HEADQUARTERS. - | Ы 
АМ. FEBRUARY, 1951, DR. ZAHORTAN WAS ARRESTED. BY 


PITTSBURGH FEI AGENTS. FOLLOWING HIS CONVICTION AT A JUNE 1991 


FRIAL am uns sewrence то prisons [ C C | 


PAGE THREE DE FEINY 09223 UNCLAS 


NY HAS PLACED DVER | |вттмеезее BEFORE THE ЕЕМҮ GRAD 
JURY meu] j 

EDNY ATTORNEYS HAVE STATED THAT THEY WILL CONTIN ЈЕ TO 
FRESS T«E FRAUD ANGLE OF THE CASE. | 

[ ЬЕ EXPECTED TO SURRENDER TQ NY FEI AGENTS ОМ 
11/22/93 FOR PRÜCESSING. ü 

IF convretep, | Faces A PRISON TERM OF 5 YEARS AND 
А POSSIBLE $250,000 FINE FOR EACH COUNT.. IF THE CORPORATION 
IS CONVICTED, IT MAY BE FINED UP TO $500, 000 PER CODNT AS WELL 
AS BEING FORFEITED TO THE U, =, GOVERNMENT, | 

AY WILL CONTINUE TG UPDATE THE BUREAU ÉN ITS ONGOING 


E] 


INVESTIGATION AS NEW DEVELOPMENTS ARISE. 


ММММ 


W.W.F.s McMahon Indicted. 


Vince McMahon, thë wrestling impresario, and his World Wrestling | 
Federation have been indicted in Brooklyn on Federal charges that they 


In a statement issued through his lawyers, .McMahon said the 
prosecutors “аге now trying to make me responsible for what the doctor 
did. I did no such thing." 4 

Ona separate charge'of possession with intent to distribute steroids 
toa W,W.F. performer in October 1989, McMahon, who had previously 
acknowledged having used 'steroids before Simple possession became a 
Federal crime in 1991, said the prosecutors, “claim that I shared some 
of those steroids with a friend and that somehow made me a dealer,” 
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FD-515 (Rev.1-1-93) Accomplishment Report С) : 
Ы О (Submit within 30 Ps from date of fed 5 Report Datel / 24/43 
# From: SAC, 


| FieNumber | Investigative Assistance or Technique Used 
1 = Used, but did not help 3 = Helped, substantially 


2 = Helped, minimally 4 = Absolutely essential 


Rating IAT 
Tech, Agnt. or Equip. 


Telephone Toll Recs. 


.Does Accomplishment Involve: 
check all that арр! 


Drugs D 
A Fugitive 0 
Bankruptcy Fraud oO 
D 
D 
D 


Computer Fraud/Abuse 
Corruption of Public Officials 
Forfeiture Assets 


Assisting Agents Soc. Sec. NoX 
Пана suensor |2 | E 
ICI EVE (pioase иа Ass — 


i Lab. Div. Field Supt. 
| i 


FO 


- Polygraph Assistanco i 
Assisting Joint Agencies X * . Sect. . Visual Invest. Anal. 
1. U.S ATs off . Sect. Show Money Usage Crisis Neg. - Fed. 


y 


Accomplishment type * ° Accomplishment Date. Serial No. of FD-515 
INO eT ENT зз 


A. Complaint / Information /d D. Recovery / Restitution / Potential Economic Loss Prevented (PELP) x + 

Also Complete Section I Recovery Code * Amount 
Serial numb 4 13- ! 2:2- (ç Г) Federal C Local 
Check if Civil / Rico Complaint [7] 


Restitution 
C) Court Ordered 
D Pretrial Agreement 


B. Arrest / Locate / Summons 
` Arrest 
П Federal O Local ¢ 
Subject Priority: OA OB OC F. AFA Payment 
C Subject Resisted . Civil / Rico Matters Amount: Ф 
CJ Subject was Armed Also Complete Section I - 
Locate Date of Complaint: U /.— / — . G. Administrative Sanctions 
Subject Priority: ПА OB OC Judgment ^ — ° Type: Length: . 
Summons Judicial Outcome xe 0 Suspension Г] Permanent 
ПІ Federal Dj Local ¢ Fines: $ - e ry C) Debarment CJ [Years | Months | 


. Hostage(s) Released Years | Months | Û Injunction ШЕК 81 
| | | 


Released by: (7) Terrorists [J Other Suspension: 
Subject Description Code: • 


Number of Hostages: 
L. U.S. Code Violations 
EDED EDED 


[7] 


H. Final Judicial Process 
Conviction 
Also Complete Section I 
Date of Complaint, Information or Indictment: ff 
Date of Conviction: | / / 


Date of Sentence: / jer O Federal 
Subject Description Code: * [1 Local $ 


Judicial State: District: 


Sentence type: Хе Ü io NR б 
Sentence Term: о $ Acquittal / Dismissal / Pretrial Diversion 
Probation Plea Date of Indictment or Information: fl. 
Years Months | Years Months = Trial Subject Description Code: ______* 44. НЕ 
ТЕК Esp (gp nia Ë 
earched 


Fines: $ ағатай 
. Subject Information (Required for Sections A, В, D (Restitution), Е, F, G, and Н) Indexed 


Nm Tate of Birth Place of Birth (if available)led __|_Social боб Моей available) | 


Transen do onian Wk | hue] we | Mr _ 


П Subject Related to an LCN, Asian Organized Crime (AOC), or Italian Organized Crime (IOC) Group. (if checked, also submit form FD-515a) 


Required for Sections A, E, and H (Conviction) 
Optional for Section B (arrest) 


x Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 
* Requires that a written explanation on plain paper be attached. (Court Ordered Restitution does not require a written explanation) 
* See codes on reverse side. 


Қышымшы а 722: a 


O 


O 


e ` 


£-.rolling performed 


11/29/93 ***** Indictment Information ***** FAAMAAO1 
SENSITIVE / UNCLASSIFIED 4 more » 

Cice File Number. . : NY0234993 196B (SN) 

Field Office. . . . : NY Rpt Date. . : 11/29/1993 


EZIIILLILIIIIIIIIIIIIIIPIIIIIPLIIIIIIIIITIIIIEIIIIIIIITTITIITITIIIITEEIITIEPEITITETIITIIIIITIE 
Current Processing Mode: ADDING RECORD 
Nane Subject . . >> TITAN SPORTS INC * 


Does This Accomplishment Involve: 


DEMOS (Y/N) з. o 3 Seo ey ж е oe ёсё ж ж MAU жоё э ee бе SP N 
A Fugitive (Y/N)« x eo се ЖЗ ж EDS ы ee eS ІМ 
Bankruptcy Fraud (Y/N). . « е 4 + + +s + + «© ow. « « >> N 
Computer Fraud/Abuse (Y/N). . . ss + + + + © +< + + + >> N 
Corruption Public Officials (Y/N) . . . . . . + + + + >> N 
Forfeiture Asset (Y/N). . e ee + + + o» € s + ox» + >> N 


Classified By: 
SENSTTIVE / UNCLASSIFIED Declassify On: 
РЕ1=Не1р PF3=Exit PF4=Pmpt PF5=Indx PF7=Bkwd PF8=Fwd PF9=Quit PF10=Left 
PF11=Right PF12=Main 


4pz NUM = 32 
Scrolling performed 
11/29/93 ***** Indictment Information ***** FAAMAAO2 
< 1 more SENSITIVE / UNCLASSIFIED 3 more » 
File Nbr . . : NY0234993 196B (SN) 
Field Office . . : NY Rpt Date . . : 11/29/1993 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 


Serial Number of FD-515. . > ........ | 
SSN Agent Claiming Stat. . >> + b6 
RA/Squad Claiming Stat . . >> D2.. / C12. + bic 
Task FOPTCÓ «э. ш w wok е e cc s RE OF 
Assist Joint Agencies. . . > ..... + ..... Cy ahh bak 
Assisting Agent SSN. . . > 1 ... -—- .. “= .... +* 
(MAX 12) Р ТҮ 
275,64 Án 
аа ае E 
Б: жый ЖТ 4235. 24% 
бола EL eee es 
UL алсы тыра тыры 
Sue cm uus Ы 
Classified By: _ 
SENSITIVE / UNCLASSIFIED Declassify On: 
PFl-Help PF3=Exit PF4=Pmpt PF5-Indx PF7=Bkwd PF8=Fwd PF9-Quit PF10-Left 
PF11=Right PF12=Main 
ABS NUM - 32 
Scrolling performed 
11/29/93 ***** Indictment Information ***** FAAMAAO4 
« 2 more SENSITIVE / UNCLASSIFIED 2 more > 
Field Office . . : NY File Nbr . . : NY0234993 196B (SN) 
RA/Squad Code. . : D2 / C12 Rpt Date . . : 11/29/1993 " 8 
SSN Stat Agnt. . еар Agnt. . : 2 | 
Subject. . . . . : INC (SN) vu 


2- 


e id 


ХХХХХХХХХХХХХХХХХХХХХХХХХХХХХКХХХХХХХКХХХХХХХЕХХХЕХХХХХХЕХХКХХХХХХХХХХХХХХХЕХХХХХЭ 
. . 9 + ы >> 11 / 18 / 1993 


Date of Indictment 
Serial Number of In 


U.S. 


PF11=Right PF12-Main 
Agi 


Scrolling performed 
11/29/93 

< 3 more 

Field Office . . 
RA/Squad Code. . 
SSN Stat Agnt. . 
Subject. . . . . 


oo +o оо өө 


Accomplishment Narr 


++ + э» ө e o ө ө o ө ө э ө ө ө ө 
э * a e ез ө 0 е е 9 ө ө Q ө е ө о 
oe e э э ө э ө ә ө ө ө ө ө ө ө ө 
* э 2. * e ə e өлө ө ө ө ө ө ө 
* ° s ç ç ө ә э ө ә ө е ө ө е ө о 
ese ө e е э ө ө ө Ф ө е ө е оо ө 
+ + э э ө ө э e о о өе ө ө ө ө о 


* e a e ç Ф е е ө о ө ә Ф ө е е ә 


488 


Scrolling performed 
11/29/93 

< 4 more 

Field Office . . 
RA/Squad Code. . 
SSN Stat Agnt. . 
Subject. . . . . 


фо ee oo oo 


Rating: 1 No Help, 2 Minimal, 3 Substantial, 4 Essential 


FINAN ANALYST 
AIRCRAFT ASST 
COMPUTER ASST 
CONSEN MONITR 
ELSUR/FISC 


PF11=Right PF12-Main 


dictment 47% 


Code Violation: 
Title Section 
> 18 371.. 
21 333.. 
21 333.. 
21 896.. 


> 


° e ө Фе ө е е 


Counts 


1.. 
1.. 
1.. 
1.. 


SENSITIVE / UNCLASSIFIED 
PFl=Help PF3=Exit PF4=Pmpt PF5-Indx PF7-Bkwd PF8=Fwd PF9-Quit PF10-Left 


NUM 


Classified By: 
Declassify On: 


***** Indictment Information ****x 
SENSITIVE / UNCLASSIFIED 

NY0234993 

11/29/1993 


NY File Nbr . 
D2 _С12 Rpt Date . 
stat Agnt. 


TITAN SPORTS INC 


ative: 


€ 9 9 ө ө € € € ө е э ө € 9 € ө € * 9 * ө ө € ө ө ç € ө ç * 9 * ө ө о ° 
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@ э ө ө о ө э о 


. 
e? о ө ө ө ө оо ө 
49%... 

° 


@ e əƏ ө е э 0@ 0 ө эө ө ө ө е е э ө ө ° ө о о о 
+ о о 9 ө ө ө ө ө ө ө е ө 9 ө ө ө оо ө ө ө ө 
+ ° ө 9 о ө ө ө ө ө ө ° ө ө э ç эө ө ө о о ө ө 


* + е o o ө ө 09? ө 9 ө € ө °? ө ө ө ооо о ө о 


oe 


* o° ө 9 € ç э ө э ө ө ө € @ э е е ө е Q @ ө € о е e€ о ө о ө ө ө е е о 


@ © о ө эө ө ә ө о Q ө ө ә ө ө е е @ ө о е ө ° ө о е ө е ө ө ө ө ө е о 


SENSITIVE / UNCLASSIFIED 
PFl-Help PF3-Exit PF4-Pmpt PF5-Indx PF7-Bkwd PF8-Fwd PF9=Quit PF10-Left 


NUM 


Clear Screen (X) . 


e о è 9 


(SN) 
kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 


. 


° + е э ө 


> 


. 
e è 9 © 9 o е 


e о 9 o о 


. о о е 


. è © 9 è oè 


Classified By: 
Declassify On: 


***** Indictment Information ***** 

SENSITIVE / UNCLASSIFIED 
NY0234993 
11/29/1993 


NY File Nbr . 
D2 C12 Rpt Date . 
Stat Agnt. 


TITAN SPORTS INC 


INFORMNT INFO 
LAB DIV EXAMS 
LAB FIELD SUP 
PEN REGISTERS 
PHOTO COVERGE 


3 


. 


oe оо Фе 


TECH AG/EQUIP 
TEL TOLL RECS 


(SN) 
kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 


UCO-GROUP I 


UCO-GROUP II 


UCO-OTHER 


32 


FAAMAA21 

1 more > 

196B (SN) 
b6 
b7C 


32 


FAAMAA22 


196B (SN) 
b6 
BIE 


Clr Sor (X) . «>. 


- `  “ 


ELSUR/III OLYGRAPH МСАУС/УІ-САР 


ENG FIELD SUP . RCH WAR EXEC VISUAL INVEST b7E 
ENG TAPE EXAM HOW MONEY CRIS NEG-FED 

HYPNOSIS ASST OG ASST I CRIS NEG-LOC 

IDENT ОТУ AST WAT TEAM 


: Classified By: 
SENSITIVE / UNCLASSIFIED Declassify On: 
PFl-Help PF3=Exit PF4-Pmpt PF5-Indx PF7=Bkwd PF8=Fwd PF9-Quit PF10-Left 
PF11=Right PF12-Main 
48% NUM il 22 
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а 

ЫТ and: а istributed esak 
. «steroids to his. wrestling 1 troops.. | 
ТА; “There аге: 50-wrestlers salivating: 


| to take the. sand SO they сап.КпосК 
“down: “МеМаһоп,” our source told us. 
“Thêy-will-all' “testify, that Vince dis- 
tributed: steroids "to. тапу of. his 
wrestlers and: that : some ‘shared. hypo-, 
¦ dérmic, needles. "Unfortunately, Hogan ` 
: is going to be, mentioned because "he's i 
Е Ше most "marketable: namé,” " ; 
“Sources tell u$; Hogan 15: ‘fearful hé. | 
might-lose his upcoming ‘Straight-to- “1 
| syndication TV series: 'from-New: iine, 3 
| “Thunder And’ Paradise,”. -in:the wake 4 
P of. the. ‘trial: He 5,8150, afraid. of. ad-: : 
P Verse, public’ S; “perception, since- he. К 
3 admitted on nàtiorial: television ‘that 4 
P neonly; ;took- “steroids three ftimes;,: ‘as Я 
раќ; оѓ: an injury, Telabilifatión. ' 4 
E^ Oursources. tell us that the: feds‘; } 
havé ‘collected. ;dozens;and, dozens, of 
| Federal: -Express receipts: for: аск д 
ages sent from .Convicted” WWF | 
-steroid physician. Dr. George. Zabori:. 
|. an to-Hogan. And t! ey-aré-browbeat® H. 
Бап the wrestling:co) ımunity:: about its 
į ‘knowledge of: the alleged courier 
transaction 


PER 


the "Fed "Ex ‘deals ith? A abont š 
i Tonk Man., “But ç 


п.с:пахе,а 
cause I,-for. бие, wai vtinyol 
; that.” | 


(Mount Clipping їп Space Below) 


[ swears rs to: ‘US Hulk was the first to bolt. = 2 | 
fromthe loêker’ ‘room-whenever:sc SOs |. 


(Indicate page, name of 
newspaper, city and state.) 


Date: [2 | [6% 


Edition: Dh tq WEIS 


لى 
Title:‏ 


[Жаа 
(зе 


Character: 


Classification: 
Submitting Office: 


DAILY NEWS | e — Wednesday, December 1, 1993. 


` 
3 


-Meanwhile,-another WWF. source - 


called steroid orgies” were:stagedt« 
The juice of choice, says: our, Source, j 


уаз iDecaduroblin. Why? At only $105 
dollàrs:à vial, $8 if you-buy.in:quanti-^ 
МУ, wlio:could: résist? о, Su NM 


SEARCHED 


жишш а а 
. JAN 19 1994 


FBI — NEW YORK 


o 1960-0-23 4475 


/%д-мү-22#4?8 = Bi 


FBI/DOJ 


+ 


Memorandum 


To 


From 


SAC II (196B-NY-234993) (P) 


: s[ [ 


d/b/a 


! RATION; 


TITAN SPORTS, 


STAMFORD, 


. FBW; MF; 
OO:NY 


CT.; 


INC., 


Captioned investigation involves a 


distribute steroids in violation. of Title 18 U.S.C. 
333. 


U.S.C. 353, 331, 


Date 12/7/93 


conspiracy to 
371 and 21 


Additionally, the corpórate, headquarters of the WORLD. ' 
WRESTLING FEDERATION at 1241 East Main Street, Stamford, cr. has 
been indicted and is subject to forfeiture. 


assigned. 


2 -= New Yofk 


It is requestd a forfeiture sub file be opened and 


€ i 
b6 
b7 
12М1 > I 
X Q 000 ,000 4 
| г OCE ', kyu 
| er Куи, 


CR- 196в-мү>234993 emi C-12) 


1 — 196B-NY-234993, 


KRW/krw: 


po, 


sub F (SA. 


[the 23093 — д} 


SEARCHED, 
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‘Grappling with Dééline 


%%4%%%%ввеееесес4есеееевеегес ; = 


- The legal ‘difficulties of Vince McMahon, 


‘latest blow to the, uh, sport of pro wres- 
С tling. «МеМаһоп, the Don: King of. the 
з Stranglehold set, faces upto eight years in 
,prison and a $500, 000 fine for. possessing 
anabolic ‘steroids and conspiring: to dis- 
‘tribute them to his, uh, athletes. . 

Of greater import, however, has been 
the inability of the spinning-toehold com- 
` munity,to find a true crossover bero since 
Hulk. Hogan retired and. ‘went, into,. uh, 
«acting: full-time. According to Dave 
: Meltzer;editor and publisher of Wrestling 
Observer Newsletter, a number of would- 
Be e.heroes—Ultimate Warrior, - Bret (Hit 


M 


n 
14 


E 4518048 TONAR SATIS NFO MESES | SOUVHOIY « d 


A 


| ted out as successors to the Hulkster, and | 
all have failed miserably. 

"Television ratings: areslippingzafd г абз 
i ‘cording 1 to Meltzer, attendance at live 
' wrestling events is down ‘since 1991 ` 


Stamford} Conin.-based Titan Spórts Inc; 
‘the parent companyiof; the: World; Wres2 


лене س‎ =, = ek wane, 


Атаға wr r= 


(Mount Clipping in Space Below) 


` who was recently indicted in federal court , 
on charges involving steroids, аге but the 


Man), ‘Hart, Lex Luger—have been trot-. 


‚ byi50%.-And: though: McMahontiied.tó' 
foster’ га wholesome: ‘iniage; för- "із, 


О 


(indicate page, name of 
newspaper, city and state.) 


12:13: 1843 

SP. Clty 5 feared 
b6 
b7c 


' Character: 
or 


[9G 8". 234993 
„Classification: 


Submitting Office: 


ЕТЕ! E) ИТТЕН TO gael eee TE у 


tling Federationpfotmer/Titan employées, 
have taken tothe tabloid talk show circuit , 
toichargesthatshiszempire was tbuiltron; Б 
sleaze#Rita-Chattertónya-formerreféree; 
accused McMahon: and othermembers of 
| hisaorgahization (с ofüsexual Harassment! 
(McMahon has filed: suit’ against Chatters 
ton in response to the allegations‘): Murs 
‚тау Hodgson, a fired announcer, said Те Р 
_ and others had been pressured to have sex 
` with homosexual WWE; executives::¢ And 
others-, talked about rampant use "of 
steroids. | | 
‘According: ;to, «Meltzer,. .McMahon’s 
company, couldcsurviveawith; McMahon 
behind bars:(His trial is.setfor;€May.2; he 
has ipleaded: innocent). ‘Вис doesn't 
seem likely. that pro wrestling will see ani 
‚ other eralike,the late. 280s, when'school: 
children:toted aréund/Hulk+lunchboxes? 
Imaginé: Years from now some:Ameri- 
cans-will Iook:báck with: iostalgia at’ the 
Hogan Era. ` - 
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TRANSMIT VIA: AIRTEL 0-2 22. R — 


CLASSIFICATION: 


FROM: Director, FBI "d 


TO: ADIC, New York (196B-NY-234993) (с-12) 


DATE: | A ` 12 /эзуэз — 


DBA 

WORLD WRESTLING FEDERATION (WWF). 
(ТТТАМ SPORTS, INC.) 

STAMFORD, CONNECTICUT 

FRAUD BY WIRE; MAIL FRAUD 


Re New York airtel irector dated 9/30/93, b6 
memorandum from Inv to Supervisory b7C 
Special Agent (SSA) 11/15/93. 

SSA [Behavioral Science Services 


Unit (BSSU), FBI Academy, Quantico, Virginia, reviewed the 


material furnished by referenced communications and developed the 
following opinions: 


Ьб 
Subject b7C 
| us material furnished does not provide x 
conclusive evidence of this fact. In context, the video tape а 
provided is of little evidentiary value because it was taken іп а 4” 
public setting and contains по obvious sexual_activity. Too many 
alternative explanations could be offered by for its 
content. 
Most problematic is the fact that no alleged "victims" 
b6 
b7C 


SEARCHED, 


SEALED AEE AED 


“ DEG 28 1993 


1% 
т 


САНИ 


Re: dba b6 
World Wrestling Federation (WWF) | 
(Titan Sports, Inc.) 

Stamford, Connecticut 
Fraud by Wire; Mail Fraud 


Unless mor or other 
corroborate evidence is found or unless victims willing to admit 
and ‘describe the sexual nature of the activity are identified, it 
is highly unlikely ]couiá be convicted in court. 


The above opinion was telephonically communicated to 
Criminal Investigator, U.S. Attorney's Office on 


1966.0 224943 


INDEXED 
FILED 
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JOHN DOE| INC. and JO DOR 


, 
Patitioners-+Appelle 


алаш, ` 
v. 


UNITED STATES OF AMERICA, 


respondent-A»pe 212%) 


Befo е: WINTER, |MINER AND WALKER, Circuit Judqeg, 

Appeal from an onder of the United States District Court fo 
the Eastprn District df New York (Charles P. Sifton, Judge) rulh. 
that the|crime-fraud dxception to the attorney-client privilege 1 
been established and gompelling testimony of an attorney before С 
grand jury. We affirn. 

JERRY S. McDEVITT, Pittsburgh, 


Pennsylvania (Laura A. Brevetti, 
Elan Gerstmann, New York, New York, 


of counsel), for Petitioners- 
Appellants. ue 
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SEAN F. O'SHEA, Assistant United 
States Attorney, Brooklyn, New York 
(Zachary W. Carter, United States 
Attorney for the Eastern District 
of New York, Peter A. Norling, 
Assistant United States. Attorney, 
rook ri, New York, of counsel), 


w 


This appeal concbrns the appropriate procedures by which a 


district court may determine the existence of the crime-fraud 


n to the attorney-client privilege. John Doe, Inc. and 


1 the CEO an 


sole shareholder of John Doe, Inc., appeal: 


ge Sifton's order compelling John Doe, Inc.'s former 


("the attorn 


y") to testify before a grand jury on the 


hat the crimerfraud exception applied to appellants’ 


n of the attorney-client privilege.” Because the 


yes employed by the district court provided. due process a) 


the district tourt articulated a sufficiently high standi 


for establishing the exception, we affirm. 
e attorney received a subpoena ordering hii 
re a grand jury. An Assistant United Stati 


("AUSA") advised the attorney that he would bé question: 


e content of fommunications with CEO John Doe and that tl 


aud exception|to the attorney-client privilege would app: 


communications because the communications involved an 


attempt by John Doe t 


suborn perjury. By letter dated May 14, 


1993, current counsel| for John Doe and John Doe, Inc. informed tl 
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llant had waived the privilege and request: 
Bpect the privilege unless and until it 


lsion order from the district court, in 


pellants’ request, on May 18, 1993, the 
compulsion order and submitted to the 
district| court for in review an ex parte sealed affidavit 
ап FBI agent, which вес out the factual basis for the government’: 
e-fraud exception. Appellants objected to 
on and requested that the district court 

of the affidavit and provide appellants an 
eir own in camera submission. In response, 
I did not examine the F.B.I. agent’s 
satisfied myself that this was a grand jury 
e grand jury was pursuing a legitimate 

the questions sought to be asked [of the 
attorney] were relevant to its inquiry." The district court then 
of the affidavit that the threshold showin 
decided to question the attorney in camera. 


or preserving grand jury secrecy, it denied 


on the basi 
had been|made, and it 
Because pf a concern 
torney’s znd appellants’ counsel that they 
to be present during the examination. 


exanination of the attorney, the distric 
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the prosecutor to determine what questions would be asked of tho 
attorney if compelled| to testify before the grand jury. The cou 
also ingtructed appellants’ counsel "not to interrogate [the 
attorney] about what Went on in camera unlesg he asks to talk on 
thé subject with [Joh Doe] and [John Doe, Inc.'5j] counselor and 
voluntaxily discloses| these matters." That afternoon, the distr 
court fqund that the fommunications at issue were "from an 
individual seeking to|solicit the assistance of the attornéy in 
Commission of a сгіпе)" and therefore concluded that the crime- 
fraud exception had bhen established. It then granted appellant 
application for a stay pending appeal. 


On June 18, 1993) appellants moved for a clarification of t 


` atandard of proof relked upon by the district court in reaching 


conclusion. Іп an order dated June 30, 1993, the district court 
responded that a statement of the standard was not required beca: 
it had found that the|crime-fraud exception had been established 
"beyond |peradventure,| and because the conclusion was "not a clo: 
question." This appeal followed. 
А. THE PROCEDURES USED BY THE DISTR OURT DID NO OLA D 
PROCESS 
Appellants argue|that their due process rights were violate: 
by their, sxclusion from the іп camera proceedings. However, tak: 
into account the necessity of preserving the secrecy of the gran 
jury, we conclude that the district court’s procedures did not 


violate Hue process, 


AO 72. 
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1 | 
1. | Appellants’ Denial of Access to the FBI Affidav and 
2 .4. = " s E J 
пар НХ o Rebu overnmen Proof Dig no одате pue process 
: Appellants argue that their inability to inspect and rebut 
Ë with evidentiary subnlssions the ex parte affidavit submitted by 
: the government runs afoul of Zolin. Тһе purpose of the attorney 
к client privilege is tp promote open communication between attorn 
7 and their clients so that fully informed legal advice may be giv 
қ Тһе crine~fraud exception strips the privilege from attorney-cli 
i communidations that "kelate to client communications in furthera 
" of contemplated or ongoing criminal or fraudulent conduct." In 
» Grand Jum . ан Tecum Dated Septembe | 383, 731 F. 
E 1032, 1038 (2d Cir. 1p84). “hat case established that in camera 
G proceedings may be usbd to détermine whether the exçeption appli 
* to particular communibations, Of course, if the attorney were 
us simply dalled to testify in an open hearing, the privileged. 
Е communications would be disclosed whether or not the exception 
ч applied, Zolin held,| however, that prior to an in camera 
5 . disclosure of the communications, "the judge should require а 
" Showing of a factual basis adequate to support a good faith beli 
d by a reasonable person . . , that іп camera roview of the materi 
i may revdal evidence tp establish the claim that the crime-fraud 
= exceptidn applies." [91 Ч.Б. at 572 (internal quotations and 
citation omitted). Plin further established that only non- 
ә privileged material mhy be used to make the threshold determinat 
7 that triggers апека review. Id. at 574. 
26 
5 
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,cautionary tone of 


parte submissions of 


` issue; land its use i 


. 567 F.2d 1183, 1188 ( 


are weak, an 


Appellants arque that under Zolin they should have. been abl: 


to examihe the affidavit submitted to the court to make 


the threshold showing 
parte examination of 


However, nothing in 29lin prohibits ex 
on-privileged threshold material. “he 
with respect to the use of in camera 
proceedings concerns the ‘disclosure of the communications, for wh: 
the privilege ін claimed. It does not address the propriety of 4 
on-privileged material. 

We recognize that. an in camera submission "deprive(s) one 
party td а proceeding of a full opportunity to be heard on an 

| justified only by a compelling interest. 
F;2d 482, 490 (24 Cir. 1982); in xe Тауісоі 
d Cir. 1977). However, in In re John Doe 


ere an in camera submission is the only wa) 


re ohn рәв Orbe, 67 


Согр., we held that. w 
to reso e an. issus without compromising a legitimate need to 
Beaders the secrecy f the. grand jury, it is an appropriate 
procedure. 675 F.2d ht 490. Of course, where concerns for веске 
| proceeding may not be justified. For 
example, in Taylor, м . 


` 


access Чо an 2 


concluded that where a party who sought 
submission would learn the contents of th 
submission as soon as|he was called as a grand jury witness, thei 
was no legitimate contern for secrecy justifying an in camera 
examination. 567 F.28 at 1188. See also In re Special septembe) | 
978 and Jyry- , 640 F.2d 49, 56-57 (7th Cir. 1980) (necess: 
of preserving grand jpry secrecy weak where evidence to be rovea. 
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is merely government 
from grand jury witne 


grand jury witnesses 


|| perceive a special ne 


. limited |access to the 


should insure that he 

In |the instant c 
affidavit and are sat 
jeopard ze-the grand 
at all dlear in the i 


Gamera submission wou 


. Moreover, there is no 


‘special need for adve 


danger that the distr 

making its determinat 

court properly procée 
Appellants were 


affidavit, and any re 


: government's submissi 


‘violative of due proc 


" + 
2. | The Dis 
Did Not Violate D p 


Appellants also 


violated by their exc 


' attorney) and by their 


fed to examine the affidavit. in camera. 


US "Cy Р.О? 


affidavit not containing testimony elicited | 
Bses, disclosure of which will not discoura 

from testifying). Also, the judge шау 

ВА for adversary examination and give full " 
government's submission. Finally, the jud: 

or she does not rely on privileged materia: 
Ase, we have independently examined the sea: 

sfied that disclosure -of the affidavit шісі 
jury investigation. Unlike Taylor, it is n 
stant case that the substance of the in 

d otherwise be revealed to’ appellants. 

hing in the affidavit that indicates a 

sary examination. Finally, we perceive no 

ct court relied upon privileged: material i: 


on. Therefore, we conclude that the distr: 


hus properly denied access to the sealed 
sultant limit- оп, Еһеік ability to rebut the 
bn was of marginal importance and not 
BSS, U 

Qurt'g In Camera Examination of the Attoi 
ocess. 
argue that their due process rights were 
usion from the in camera examination of the 
inability to question him after the 
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ion. They argue that thair participation wag necessary 
t to make a fhir determination. of whether the crime-frat 
ign had been established and that it ig difficult for a jv 
gutral when prpsented with potentially incriminating 
without ‘coun ervailing argument. Due process, however, 
requird prooBdurab mora: extensive than were employed by 
ríct court. 5 
light of the district. court's legitimate concern that th 
of the grand fury be preserved, ite in camera examinatic 
ttorney was the most effective method of determining tha 
e-fraud exception had. been established. ‘The district cc 
| a review of the allegedly privileged 
ation only afiter oral argument and after the threshold 
required by Zolin was made. Then, on. the basis of 


ition garnered fron the affidavit, oral argument, and the 


э John Doe Corp,, 675 F.2d at 490-91. In 
in Zolin held that "in camera review may be 


secrecy. 
, the Court 
determine whether allegedly privileged attorney-client 
ations fall ithin the: crime-fraud exception." Zolin, 4 
574. Nothing in Zolin indicates that, once a threshold 


8 
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showing has been made any additional safeguards are required. 

Appellants also bbject to the district court's instruction 
that ‘they not interroyate the Attorney after the in camera 
examination, However) there was no due process right to 
interrogate the attorney, who was a potential grand jury witness 
and no longer represe ted appellants. Because Judge sifton brie 
met with the prosecutbr before examining the attorney to determi 
the typés of questions that might be asked in the grand jury, 
allowing appellants tb discover the contents of the ln camera 
communication between the district court and the attorney would 
have beén tantamount [o revealing grand jury testimony. Thus, t 
value of the in camera proceeding could be preserved only by tha 
court'a instruction. By precluding appellants from interrogatir 
the attorney unless 2 volunteered the information, the district 
court p operly balanded concerns for secrecy and the ability of 
grand jüry witnesses [co testify freely and openly against 
appellants’ interest jin asserting the attorney-client privilege. 
B. HE| DISTRI OURT APE DA ICIEN HIGH S ANDARD O 

PROOF 

Appellants argud that the district court erred in failing t 
articulate a legally defined standard of proof when ruling that 
government had established the crime-fraud exception. They furt 
argue that under Zolin the court should have articulated a stanc 
higher than "probabld cause," such as "clear and convincing 


evidence." 
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this case, wd do not need to reach the issue of whether 


quires a higher standard of proof. Currently, we requi: 


that a party seeking to overcome the attorney-client privilege : 


the crine-fraud excep ion must ghow that there is "probable саш 


to belié 


communi 


This ste 
person 
attempte 
communi 
court's 
peradve 
from an 
attorna 
close q 
there wa 
fraud e 
Fu 


transcri 


satisfi& 


appella 


ve that a crima or fraud ha[s] been committed and that + 
ations were in furtherance thereof." in re Grand Jury 
Duces Tecum Dated September 1 983, 731 F.2d at 1039 
ndard Бий bedn rephrased ан requiring "that a prudent 
ave a reasonable basis to suspact the perpetration or 
d perpetratidn of a crime or fraud, and that the 
ations were jn furtherance thereof." 14, Тһе district 
statements that it had been established "beyond  ' 
ture that thd communications at issue wara communicatio 
individual sdeking, to solicit the assistance of the 
іп the commission of a crime" and that "[t]his was not 
estion," indicate that tho court effectively found that 
в more than г reasonable basis to suspect that the crim 


ception was astablished. 


hermore, based upon our own independent examination of 
pt of the in|camera examination of the attorney, we are 
a that even the "clear and convincing” standard propose: 


ts is mot. The district court's failure to articulate | 


standard is thus of ro consequence. 


We 


therefore affirn. . 


10 
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FOOTNOTES 


l. Because this appehl involves proceedings currently before a 
grand jury, and the briefs and record on appeal are under seal, 


employ pseudonyms to preserve anonynity. 


2. At previous stages in this case, the government has disputed 
that there was an attbrney-client relationship between the attor 
e government does not, however, raise this 


argument on appeal. 
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T ANON na——— 


w. A CHECK IN THIS COLUMN INDICATES A HOLO HAS BEEN PLACED AGAINST YOU ON 
AUTHORITY OF AN OUT-OF-COUNTY WARRANT. 
YOU ARE HEREBY NOTIFIED UNDER THESE CIRCUMSTANCES YOU MAY REQUEST A COURT APPEARANCE IN THIS COUNTY 
FOR THE PURPOSE OF SEING AOMITTEO TO BAIL ON THE CHARGE SET FORTH ON THE OUT-OF-COUNTY WARRANT, IF 
YOU OESIRE A COURT APPEARANCE FOR THIS PURPOSE, NOTIFY YOUR JAILER, (821 & 822 P.C.) 
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L.A. IMPACT 
BAIL DEVIATION REQUEST 
Full Name of Arrestea: [| bre 


Booking / Host File #: Фү 54315 | 00544-о37% | 
Charge: 5112 PC 120 i 


* o oo 


Ball Called for in Schedule: 
Address of Jall or Station at Which Arrestee 18 Now Held: SL У Qo Р, D, 


Telephone Number of Above Location 
Declarant's Name, Rank and Detal 


Reason for Requested Ball Deviation: b 
THE AüfgaTzÉ v» QA. d 


| request deviation from the felony ball echedule, and | believe that ball should be 
fixed In the sum of: j 


| 


* 


{ declare unda заг TV OF nanurv Ina пе toredgoind n nd correct. 
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LOS ANGELES INTE. GENCY METROPOLITAN POLICE APPREHENSION CRIME TASK FORCE 


` ARREST REPORT 
Lait: TH- |— los HOST FILE #: 44-0228 ^ BKG#: 3849339 


b6 
CASE AGENT: DATE: 2/2. /94 j 
NARRATIVE: 


On Wednesday 2/2/94 at approximately 2115 hours, I рекетте] 


ME with assisting officers from pact Group 1 
The warrant was issued on 2/2/94, signed by sue — j 
l Court. 


of the Culver City Municipa 


The suspect in the case [| came to the door, where I made 

. contact with him and told him that I had a Search warrant for his 
residence and vehicle. He was subsequently detained without 
incident. 


© ل“ 
e‏ 


өзе 


Upon а search of the residence, I located a large quantity 
(estimated at over osage units) of illegal anabolic steroids, 
in his bedroom along with several loaded assault type weapons. 


I also located an additional large quantity of anabolic steroids, 
and two sawed-off shotguns in another bedroom of the house. 


EN then taken into custody and transported to the El Segundo 
Police Jail Facility for booking on a violation of H&S 11377. 


All property was retained for further investigation, and subsequent 
Supplemental, property, and evidence reports to follow. 


Arresting/Reporting Officer ing 


L A. IMPACT Form 25 (#916 
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BACKGROUND 


The U.S. Customs Service intercepted a parcel mailed from Italy to 
the United States which contained anabolic steroids. L.A. Impact 
Investigators from Group I Teams 1 & 2 initiated an investigation, 
surveillance, and a controlled delivery of the steroids which were 
addressed to a private mail box in Marina Del Rey. 


During the course of the investigation, a search warrant b6 
obtained and served at a résidence located ¿I с=с сеч b7C 
in the City of Hawthorne. ; 
Two primary suspects were eventually identified and are listed 
below; 2" 
1. 

Hawthorne b6 

b7C 

2. 

Hawthorne 


An additional female white adult was inside the 'residence during 
the service of the search war and identified herself as 'the 
girlfriend of suspect naned; 


Synopsis . 
On' 2/2/94 at approximately 2115 hours, I, Detective Ші 2221 bé 
armed with a search’ warrant issued on 2/2/94 signe y the b7C 
Honorable Judge Antonio Barretto, of the Culver ity Municipal 
Court, served a search warrant ажа ЕН Hawthorne. 


Assistinq me re t g officers; 
Sqt Det. Det. Det. 
Det. Det. UCCS 
Hawthorne Police Department TO icer| | 


LA. 


Date: 2/1/44 _ investigator DET] ____| "EN 
IMPACT Form 770891 € 


ОЎ А. IMPA CT 
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Utilizing a ruse, officer] ^ ]knockea on the front door and 
waited for just a few moments before opened the door. „ү. 
Office keal [Ee step outside in order to talk to <c 
him regarding a parking violation on his vehicle. This was done in 
order to avoid a violent confrontation. 


Аз soon as lexitea the residence: I approached him, displayed „e 
a copy of the search warra on for пе pyc 
being there. [ (апа his were then 
detained without incident. 


I took a brief look inside the house prior to the' actual search, 
and observed the U.S. mail parcel containing the anabolic steroids 
on a table in the S/E bedroom. 


тп talking o — Jh stated that he is the owner of the house 

and t e g арыса U the S/E bedroom. When I b6 
2. the package, he stated that he just picked it up 572 
today at the mail box rental business for his roommate, and that he 

did not know the contents. 


Prior to the search, I examined the interior of the house and 
“noticed that it was a two bedroom house, with a small den located 
in the rear. Towards the front of the house are a living room, 
kitchen and dining area. There is a detached garage located on the Das 
east side of the property. [ .. ]had told me that he has owned the ” 
house for the past six months, and that his roommate ses 

there rent free. 


I began a systematic search of the interior of the house and 
located the previously described mail package, ы) 
anabolic steroids іп the S/E bedroom which belonged to and 
addressed to 


OS 


о 


Also contained in this bedroom were two sawed-off shotguns. Опе 
was on the:same table with the steroids in the U.S. mail package. 
The other was in the closet which was loaded (evidence item #20). 


I also located a large quantity of anabolic steroids in this same 
m. There were all varieties of steroids estimated at over 
individual dosage units, including tablets and injectables 

along with a large quantity of Oy pocenie syringes, (evidence items 

21- 10). 


Additionally іп this same room were over i i 
апа — Tos was also a large quantity of bg 


paraphernalia. b7c 


Date: 22/11/44. Investigator: оет] Supervisor 
К š LA 


| 


| 
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I retrieved two separate illegal weapons from this room. The 


Refer to evidence item #'s 


13 & 19.. m 
I then searched the S/W bedroom, which is the bedroom belonging to 

I found several weapons, all loaded in this room including „e 
an illegal i i b7 
other weapons include a 


In addition the weapons found’ in this room, 


weapon in the dinind room area. The weapon, а 
сс, mounted under the dining room table, А 
specially constructed bracket was mounted under the table, that 


would hold the weapon by the barrel. This would allow easy access 
to the weapon by anyone sitting at the table. This weapon was 
loaded with 13 live rounds. 


both of which were in boxes. I later spoke ү 
with Department of Justice/Bureau of Narcotic Enforcement Special p7c 
agent Poo oe the DEA/DOJ San Diego Task Force. 


Special Agent told me that the of the ,. 
generic would at the low end ld last 55. 
for just over two years, with no breáks in cycles. If there are 


cycles of six weeks with six week breaks in between, then the 
supply would last for over four years. А 


In searching the Den/Family room in the rear of the residence, I Ба 
found another weapon, а pistol and over 1300 rounds of 7C 
live ammunition of various typ also had a "Point Blank" | 

bullet proof vest in his bedroom which was not seized. 


After a search of the residence was completed, г] was 
transported to the Police Department Jail Facility for 
booking on a charge o 11377. b6 


oae: jafi esso DET шмш: 
L. A. 


MÀ —— 


om 7/0 


=. 
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While at the [ | ]station, I interviéwea| || and read to him a 
Miranda admonishment form which' he signed, and stated that he 
understood his rights wished to talk to me without an attorney 
present. 


stated that he has owned and lived in the house for 
approximately six months. He admitted to picking up the package bé 
at the private mail box but denied having any knowledge of its 57 
contents. He said that the package was his roommate's, Jand 
that he frequently picks up mail and packages for hin. 


[é |]said that the - bedroom belongs to[ and that[ | 


does not pay rent. said that he is on the road approximately pE 
300 days a year as he is a professional wrestler in the World ү 
Wrestling Federation. He said that[ J]stays there rent free 
and takes care of the house and his dog when he is on the road. 


enied any knowledge of the steroids that were located in  ,. 
room. When I asked him about the steroids in his room, he jc 
enied any knowledge of the steroids and denies's being a steroid 
user. 


told me that between the time that he was brought into the 
station for booking, and the ti t he spoke to me, he spoke to | 
his girlfriend on the phone. [said that his girlfriend told ^ 
him that she found the two boxes, which she told him she did not ~'~ 
know the contents, but contained the steroids and the hypodermic 
syringes in the den area of the house that day, and just put them 
in the night stand of their bedroom that day. 


I found this statement very unusual, in that| told me that his 
girlfriend claimed to not know what was in the boxes. However, the 
box containing the hypodermic syringes had a label from a Santa — 
Monica Drug store called, "Ethical Drugs", 1402 Third Street 


Promenade, (310) 395= this label was the name of 
[  lsirlfriena, | 


I noticed that[  ]became р еи stated "Oh Yeah, K 


I use those needles because I am a 


said that he. does not presently use steroids but did 5 - 6 ` 
years ago when he was power lifting. He said that he knew his ^^ 
roommate was using steroids but had no knowledge as to the 
extent of usage, sales or distribution of steroids. . 


Date: БҮЛІГІ Investigator: |. core 


LA. 


OZL.À. IMPACT 
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I asked[ ^  ]if he had any property i| ^  ] room and he said „ 
that he did not. How nd five various sized prescription + 
medication bottles i room with| ^  ]name on then. 


I asked ау he had so many guns and why they were all loaded. 
He stated that he is a gun collector and that he uses the guns for Н 
personal protection in case someone tries to break into his house. = 
I asked why he had the[ ^ ]mounted under the dining room ` 
table and he stated the same reason. 


I also asked [ | bbout the bullet proof vest in his room, and his „ү 
reply was that he was afraid for his safety due to the recent riots yo. 
in Los Angeles. 


had nothing further to add so I terminated my interview with 
him. 


4 


proe further my investigation and focus onl ] aka 5 
ака] 4 | 
I spoke to U.S. Customs Service Special Agent 
to conduct backqround information on А _ 
z рё 
learned that iis an x 
or 


rom who has priors arrests Mpersonating a Police 


Officer_in the State of New York, and that his records indicate 
that[ — Jis a member of the] 2 — SS res 


On Thursday 2/3/94, I received a phone call from a male subject who 


claimed to be the attorney for This male identified °° 
himself as attorney that he would have[ ] ^" 
turn himself into me at the PD Headquarters on Monday 
2/7/94. 


On 2/7/94 at approximately 1030 hours[ |. | | |] turned 6 
himself into Bp for booking on a charge of H&S 11378 and ^'^ 
PC 12020 for the possession of the two sawed-off shotguns. 


Immediately i al Agent us and I 


interviewed I read, explained and had him 
sign a Miranda admonishment form. He stated that he understood his 
rights and would talk to us without an attorney present. 


stated that he has been living in the house with his . 
IMS ESTE TIUS S. for the past six months, and that he pays в 
approximately a month for rent. He said that he did own both ртс 
of the sawed-off shotguns however he thought that one of the 
shotguns was an antique. 


Date: -4h[a4 _ mosis tet] | Supervisor: 


L. A. IMPXCT Form 7 / 08-91 € 
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NEN. C being a member of the = 
ut said that he knew members of n е also denied any A 


other previous arrests other that a couple of drunk driving arrests 
in the past. 


any specifics, other than saying that his roommate Was  b7C 
upset about what had happened. 


At this time[ ^  ]attóérney, 


Jai ted to see his cIient. be 
told me that advised not to make any 775 
Statement, so Sap e 7 our interview with him. 


Said that he was aware of the steroids, but did not дек into ps 


REQUEST FOR ADDITIONAL CHARGES: 


I would request that the LA County District Attorney's Office file 
a charge of H&S 11378, Possession for Sale of Anabolic Steroids, 
and P.C. 12020, Possession of a Prohibited Weapon for the two 
Sawed-off shotguns, the modified bas b6 
club/brass knuckles against Suspect bic 


I would also request that a charge of H&S 11378, Possession for 
Sale of Anabolic Steroids, and P.C. 12028 Possession of a 
ibi apon, an "021" assault weapon be filed against Suspect | 
wass Additionally, I would request the appropriate be 
enhancement for being armed while in possession of a controlled | 
substance for sale due to the types and placement of the various 


weapons tha ad in his possession at the time of'the service 
of the search warrant. 


b6 
b7C 


Date: 2/9/94 . investigator per] | Supervisor 
LA. ‘orm 7/08-91 € 
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STATE OF CALIFORNIA - COUNTY ОР LOS ANGELES 


SEARCH WAR D AFFIDAVIT 
ы ( À IT) 


I, Detective being sworn, says that on the 
basis of the information contained within this Search Warrant and 
the attached and incorporated Statement of Probable Cause, has 
probable cause to believe and does believe that the property 


described below is lawfully seizable, pursuant to Penal Code . 


Section 1524, as indicated below and is now located at the 
location(s) set forth below. Wherefore, Affiant requests that this 


Night Search Requested: Yes X. No 


(Bignature of Affiant) 


(SEARCH WARRANT) 


THE PEOPLE OF THE STATE OF CALIFORNIA TO ANY SHERIFF, POLICEMAN OR 


PEACE OFFICER IN THE COUNTY OF LOS ANGELES: roof by Affidavit 
having been made before me by Detective pee ec. put 
there is probable cause to believe tha e property described 


herein may be found at the location(s) set forth herein and that it 
is lawfully seizable, pursuant to Penal Code Section 1524 as 
indicated below by "x" in that: 


Was stolen or embezzled. 
Was used as a means of committing a felony 


X Was used by a person with the intent to use it as a means of 
committing a public offense or is possessed by another to whom 
he/she may have delivered it for the purpose of concealing it 
or preventing its discovery. 


X Tends to show that a felony has been committed or that a 
particular person has committed a felony. 


Tends to show that sexual exploitation of a child, in 
violation of Penal Code Section 311.3, has occurred or is 
occurring. 


b6 
bue 


O | . О 


YOU ARE THEREFORE COMMANDED TO SEARCH: 


8ее Attachment А 


FOR THE FOLLOWING PROPERTY: 


See Attachment B 


AND TO SEIZE IT, IF FOUND and bring it forthwith before me, or this 
court, at the courthouse of this court. This Search Warrant and 
incorporated Affidavit was sworn to and subscribed before me this 


t ei day of t олла, __, 199 Ч at _ $7". _ an/pm; 
Wherefore, find probable caus for the issuance of this Search 
Warrant and do issue it» 


then Gren ہہک‎ de Night Search Approved: Yes >C No 
(Signature of Magistrate) | 


/ 
Judge оғ the Superior (Municipal court C— 


Judicial District. 


YOU ARE THEREFORE COMMANDED TO SEARCH: 


r deity or —] county of Los 
ngeles; further described as a single stor single famil 


ATTACHMENT A 


residence, 


A vehicle ү, 
iden cation n er, no vehicle ,;- 
registration information available. қ 


further described ав а 


56 
b7C 


Mail Boxes Etc. 13428 Maxella, Marina Del i of Los 
Angeles, County of Los Angeles, box numbers F iie. b6 
described as a mail box rental business located іп a shopping ртс 
center located at the south-west corner of Glencoe and 


Maxella. 


О f © 


ATTACHMENT В 


Anabolic steroids, androgenic steroids Human Chorionic 
Gonadotrophin (HCG), Human Growth Hormone (HGH) or other similar 
controlled substances under federal or California law used for 
body building purposes and all illegally marketed drugs, such as 
GHB, which have not obtained the approval of the Food and Drug 
Administration for dispensing to patients. 


All records, including but not limited to patient records and 
associated medical records, which show the administration or 
dispensing of anabolic steroids, androgenic steroids, Human 
Chorionic Gonadotrophin (HCG), Human Growth Hormone (HGH), other 


controlled substances under federal or California law, or illegally 


marketed drugs, such as GHB, which have not obtained the approval 
of the Food and Drug Administration for dispensing to patients. 


All documents that relate to or show the purpose or other 
acquisition of anabolic steroids, androgenic steroids, Human 
Chorionic Gonadotrophin (HCG), Human Growth Hormone (HGH) other 
controlled substances under federal or California law, or their 
ingredients, or illegally marketed drugs, such as GHB, which have 
not obtained the approval of the Food and Drug Administration, 
including, but not limited to, order forms, invoices, shipping 
records, sales slips, bills of lading and receipts. 


All documents that show the holding or dispensing or other 
distribution of anabolic steroids, androgenic steroids, Human 
Chorionic Gonadotrophin (HCG), Human Growth Hormone (HGH), other 
controlled substances under federal or California Law, or illegally 
marketed drugs, such as GHB, which have not obtained the approval 
of the Food and Drug Administration, including, but not limited to, 
prescription forms, order forms, invoices, shipping records, sales 
Slips, bills of lading and receipts. 


All documents, telephone messages or other retrievable information 
that show any communication of listing of person who are customers 
or suppliers of the drugs described above, whether they be in the 
form of separate documentary records, computerized records or 
records maintained in any other form which allows information to be 
Stored and retrieved. 


Such other property as constitutes evidence or the 
instrumentalities of criminal conduct, the facts of such conduct, 
and such contraband and other property intended for use in the 
commission of criminal acts. | 


Апу апа all documents tending to establish the identity оғ 
person(s) in control of the premises being searched, to include 
utility bills, rent receipts, cancelled mail envelopes, mail box 
keys, and various forms of identification. The search is to 
include any outbuildings which are in control of the persons 
found at the location(s) being searched. 


ЕХРЕВ b6 
DETECTIVE b7C 


Your affiant is currently assigned to the Los Angeles Interagency 
Metropolitan Police Apprehension Crime Task Force, (L.A. PACT). 
Your affiant has been a police officer for approximately years, 


o different police agencies. The first agency was 
Police Department where your affiant was employed 

While employed by the ШЕШ 
epartment, your а iant worked a variety of 
i i ing officer, a temporar 


assignments, incl 
assignment on the 
months, as a 
and as a 
When assigned as a Detective in the your 
affiant was responsible for the investigation of major crimes 


including burglary, robbery and homic Your 
affiant also participated in E 
While assigned to the narcotics detail, your affiant conducted over 
separate narcotic investigations including surveillance, the 
writing and serving of search warrants, and all areas of narcotic 
enforcement including working in an undercover capacity, and had 


purchased narcotics while working in such capacity. Your affiant 
has been employed with the Culver City Police Department since 


and has worked as a patrol officer, field trainin 
and in the J 
i aining staff 


for the past 
years, and teach a variety of subjects including physical 
training, responding to crimes in progress, and narcotic 
recognition and identification. Your affiant is part of the 
training staff in all narcotic training courses, and has 


certified course in 

Your affiant has held in- 

service training courses for other police officers in the 

identification of persons under the influence of controlled 
substances, specifically Heroin, Cocaine'and PCP. 


Your affiant has attended and completed over[ i advanced 
officer training courses in a variety of subjects with 
approximately 75% concentrated in the area of narcotic enforcement. 
Your affiant is currently a member of the Ca ia Narcotic 
Officers! Association and has been for the past years. Your 
affiant has regularly attended[ ^ |yeariy training conferences and 
bi-monthly training sessions during jy, BOSE Your affiant 
is also a member of the Internationa Narcotic  Officers' 
Association and receives monthly bulletins and training manuals. 


Your affiant estimates that he has personally arrested ever 1 
persons for various narcotic influence, possession, possession for 
sales, and sales violations, and has directly or indirectly 
participated in another[ [related investigations. 


О | O 


STATEMENT OF PROBABLE CAUSE 


On January 31, 1994, your Affiant, Detective ade 
contact with Investigator of the U.S. Customs 
Service. Investigator told your affiant the U.S. Customs 


service, had intercepted, a package in the U.S. Mail. 

“4 Caseg, (M 
Contained in this 5. were 175 separate ampules of anabolic 
steroids. Тһе package was mailed and postmarked on 1/20/94 from 


Italy to an ad i The package was 
addressed to БЕ 
California 90292-567, fro eae 


On February 1, 1994, your affiant responded to the U.S. Customs 
Service Office located at 222 N. Sepulveda, El Segundo and took 


possession of the package from the custody of U.S. Customs Special 


Your affiant subsequently inspected the contents of the package and 
did in fact observe that the contents were anabolic steroids. 
There were 157 separate ampules of "Testovis 100mg Testosterone 
Propionato", 17 separate ampules of "Steranabol Ritardo, Oxabolone 
25mg", and one ampule of "Testosterone Cypionate Injection 10m1". 


Your affiant conducted an investigation of the mailing address on 
the package, and learned that it was a private mail box, or 
commonly referred to as a "mail drop" with a business name of "Mail 
Boxes Etc.". 


During the past year that your affiant has been assigned to LA 
Impact, your affiant has investigated several of these types of 
cases. Within the body building circles, it is common knowledge 
that Italy has good quality anabolic steroids, and they are easier 
to obtain through both legitimate and illegitimate means. 


Importers, which may or may not be body builders will usually 
receive anabolic steroids through the mail, usually utilizing a 
private mail box address in order to elude law enforcement efforts 
to locate them. In many cases, the same individual will utilize 
more than one private mail box address. 


Your affiant also conducted an investigation on the name on the 
package | stration! Your affiant could find no drivers license, 
vehicle registration or criminal history information on this name. 
Based on your affiant's experience in the investigation of illegal 
anabolic steroid importation, it is common for persons involved in 
this type of activity to use false names in order to thwart or 
elude law enforcement efforts to locate them. 


On February 1, 1 of LA Impact responded to 
Mail Boxes Etc., Marina Del Rey to ascertain 
information of Box 


‚© 


Detective| ]iearnea that the bo, 


build with 2° 
listed an ` 
Los Angeles 90031, and a phone 
There was no further information on 


address o 
number of 


Detective [ _ ]attemptea to locate drivers i vehicle b6 
registration or criminal history information оп but was 570 


unable to locate any information. 


Detective veral employees regarding [ ^ |ana 
learned ae a body builder type of individual 
who frequently is in the mail box business during the day time °° 
hours. F has received several similar packages from Italy in 
the past which he has picked up, and has had another male white 


adult also pick-up packages for him in the past. 


Detective learned that this other male also rents out a 

priva i ili i her male is 

named escribed as |, 

being pete el | b7C 
er and a professiona 


Y 
orld Wrestling Federation, who goes by the name of 


Detective [ |. |1earnea that ЕЕЕ in the past displayed ,; 
overbearing and violent behavior while in the mail box business and ъс 
епа ҒЗ usually has a handgun in his possession. 


Detectivd ^ also learned that[ j] ak — — ^ jhave on 
many occasions arrived at the mail box business together where they 
have both taken possession of similar types of packages. Detective ьс 
Eco ane out that they usually both arrive in a full sized dark 7с 
О 


red[ | pick-up mail and packages and leave the 
business. Detective 


learned throu is interviews with 
employees at the mail box business, that and| | may be 
living together at an unknown location. 


Detective[ ^  |conducted a criminal history on| jand learned 
that he had been convicted of a violation of P.C. 12025 on 9/13/93, 

and had been arrested by the Los Angeles PD on 5/7/93 for a - 
violation of P.C. 496(а). At the time of the writing of this °° 
affidavit, it could not be determined the outcome of that case. In ^'^ 
addition to the criminal histo information obtained on 

your affiant also learned that[ — is the registered owner of a 
Smith 6 e 9MM semi-automatic pistol, model 469, serial 


On February 2, 1994 your affiant learned through rior е 
arrests that he listed а home address of in {se 


the City of Hawthorne. 


o о 


On Wednesday February 2, 1994, your affiant along with assisting 
officers from LA Impact ‘conducted two separate surveillances. 


A surveillance was set-up on Mail Boxes Etc. and officers delivered 
the package containing the steroids to the business, in an attempt 
to determine who would pick-up the package under a controlled 
condition. 


A separate surveillance e Hawthorne address in an b6 
attempt to locate either and follow them until the bic 


package was picked up. 


When Detective[___ þrrived at the Hawthorne addres e observed 
a fulled sized brand new with paper ,. 


plates in front of the residence. Parked anne was а 1974 ,-- 


Chevrolet with a ersonalized late of which is 


At approximately 2:40pm, surveilling officers observed[ ^ hnd an 
unidentified dult exit the residence and bé 
get into the They followed and the female Р’ 
directly to the mail box business on Maxella in Marina Del Rey 
where they parked and both went inside. 


An undercover officer was inside Mail Boxes Etc. “Ад hna the 
female walked in. The undercover officer observed and heard 


ask for his mail and the mail а kage from box An kë 
employee of the business then gave the package containing the b7c 
steroids. The undercover officer also heard mention to the 


employee of the business that.he was expecting a similar package in 
the next day or two arriving via UPS, and to call him when it 
arrived. 


After picking up kage containing the steroids, surveilling 
officers followed and the female to the City of Santa Monica pe 
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anabolic ster bolic wend aeg found in the bc 
possession of and in th qo А and 
the that is driving. 
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suspects and_locations, and due to the criminal past and weapon ,.. 
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MIRANDA WARNING 
1. You have the right to remain silent. 
2. Anything you say can and will be used against you in a court of law. 


3. You have the right to talk to a lawyer and have him present with you 
while you are being questioned. 


4. If you cannot afford to hire a lawyer, one will be appointed, free of 
charge, to represent you before any questions, if you wish. 


1. Do you understand each of these rights | have explained to you? 
2. Having these rights in mind, do you wish to talk to us now? 
WAIVER 


Ihave read this statement of my rights, or | have been informed orally of my rights, 
and understand what my rights are. lam willing to make a statement and answer 
questions. | do not want a lawyer. | understand and know what 1 am doing. No 
promises or threats have been made to me and no pressure or coercion of any 
kind has been made against me. 
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C) WITNESS C PRISONER PROPERTY C) OTHER 


perty Booked To NAME (Secondary Persons) G MISDEMEANOR 
ү з. O FELONY 


UORES ADDRESS AAR 
1. 


2. 
PHO 
е MODEL Q BOY'S C GIRL'S FRAME COLOR WHEEL SIZE 
SPEED 1G 30 50 
10 — 1 OTHER C) 


FOUND PROPERTY STATEMENT: 00 YOU WISH TO CLAIM THIS PROPERTY IF THE LEGAL OWNER CANNOT BE LOCATED? © YES O NO 
PROPERTY CAN BE CLAIMED AFTER 90 DAYS DATE. FINDER SIGNATURE : 
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ВАРЅ1 CRIMINAL HISTORY ID INQUIRY - cus, «Cs, NCIC CIII)Page 1 of 
--%-----4-- T0: 1,756 FROM: JDIC 2-FEB-1994 23:17:59 --- `. l 


RE: QHY.CAà0192302.10460066[ — — ] DATE:02-02-94 ТІМЕ:23:13:58 b6 
КЕБТЕІСТЕр-0р NOT USE FOR EMPLOYMENT, LICENSING OR CERTIFICAT 211 PURPOSES b7C 


ARR/DET/CITE: | МАМ:01 no] | ; БЫЛО 


05-07-93 CAPD LOS ANGELES 


CNT:01 #2467271H-3525268 
496(A) PC-RECEIVE/ETC KNOWN STOLEN PROPERTY 
ж Ж k END QE MESSAGE ж Ж. * 


— < سر ندا‎ ы а 


` мч, 
En 


l 


b 8532385 
‘APS CRIMINAL HISTORY NAMERINQUIRY - CALIF (CHS, MHEAÑ), NCIC (ПІРзде l ar Í 
‚---------- T0: LISG FROM: JDIC 2-ЕЕв-ҚУА 23:16:45 ------------ 
H 5 


E:GHa.Ca0192302.NAM] sd) marzzE:02-02-94 TIME: 29:12:44 
ESTRICTEN-DN NOT USE FOR EHPLOYMENT.LICENSING OX CERTIFICATION PURPOSES 
‘TIN ARREST 


CII ГОВ S R HGT EYE HAT 


k Ж X k k Ж END OF MESSAGE D: А k x k K D: 
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` nez 
HISTORY/ARKEST RECORD IERQUIRY = JOS.Cr3 зае. 


PHI 
то: шее 37) JDIC 2-FEB- Ka 23:21:12 | 
PHOS — TRAILER à APPL STORY INFORMATION - 16 Я 
ПАЧА +: : LA +: Fç 
LAST МАМЕ: С sapi MINGLE: 
НТ ПТ ACT 
050793 ARR AGY СА0199990 СНР-СМТЕІ LA STA FILE ЕК 3522268 
CHG 496.1PC LEVEL E RECEIVE KNOWN STOLEN PROPERTY 
DISP ; CNY CHG} 
not CASE SP EXP ПТ CNY CHÍf32 
COURT SENT 
AGY FILE BKG 
CHG LEVEL 
HISP CNY CHG1 
пор CASE SP EXP ПТ CNY CHGS 
COURT _ SENT 
AGY EILE EKG 
CHG LEVEL 
‚ BISP CNY CHG] 
пай CASE SP EXP IT CNU CHG2 
COURT SENT 
NO MORE RECORD FOR MAIN NUMBER | 
info - Paqe sent to vour local printer Messaaes 3 
PHI ISTORY/ARREST RECORD INQUIRY ~- 105.СРзае 1 of 1 
---------- TO: LTSG EROM? JDIC 2-FEB-1994 23:21:13 ------------ 
PHOS - PERSONAL HISTORY INFORMATION - JDS 
MAIN +: AFIS CODE: LASD LAPD 8 AKA COUNT: 00. 


LAST aT FIRST: MIDDLE: 


SEX: H RACE: Ш HaIR:| — |zves:[  ]wer:[  ]wsr:[ nare. or sigra: | 


NCER: CII Ф: DATE LAST PHOTO: 000000 
HCEL: EBI 4: SUMMARY PROB IND: 
вар EING : LA 4: DATE OF BIRTH CNT: 01 
PERSON CLASSIFICATION: C DL 4: DRIVER’S LIC CNT: 91 

š SOC $: SOC SEC NO CNT: 01 
UNDER INVEST. 1: =* 2: 3: 
PHYS ODD/SCARS/MARKS/TATTOOS: ТАТ R SHLD TAT L ARM 
ш — DIR: U ST NAME: АРТ: 
CITY: ST: СА ZIP: 00000 HOW LONG: YRS MOS 
PREU A I - 


NIO т rage sent to your local printer "essaaes 3 

PHI PERSONAL HISTORY/ARREST RECORD ISQUIRY - Ј05,СРазе 1 or 1| 
===. T0: LISG FROM: JDIC 2-FEB 94 23:21:16 ---------... 
PHO9 — MULTIPLE AünREÉSSES - JUS 56 
MAIN E: 044 PC 
LAST NAME: EIRST:[ —— ] iu ] 
STREET HD IR STREET NAME APT CITY | 2 YRS MOS 
HQ MORE DATA . 
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.nfo - Page sent to your local printer 
PHI ISTORY/ARREST RECORD INQUIRY - JDS.CPaae 1 of 
-— m me m me =e TO: LTSG FROM: ІШІС 2-FEB-1994 23:21:17 ------------ 


PHOS - MULTIPLE ID NUMBERS - BOB. DL #, SOC Ф - JDS 


MAIN Ф: 04496118 bé 
LAST NaME:[ — ] EiRsT:[ | MIDDLE: [ lU ] b7c 
ПАТЕ OF BIRTH DRIVERS LICENSE # SOCIAL SECURITY + 

NO MORE ID NUMBERS FOR MAIN NUMBER 
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TO: чер с] FROM: JDIC 2-FEB(Y94 23:11:31 
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'ATE:02-02-94AT IME:23:094 bs 
‘MATCHED ON:AL/NAE/NA MIA BD 

HV RECORD FOR LAW ENFORCEMENT USE ONLY 

L7N0:43039193XB/1:01-06- 


ES/ADR: AS UF 08-24-93: 
THAIR AS. OF 10—-01-93:1220 VENICE BU 203 UENICE X 


DENTIEYING INFORMATION: a" ` 
= b7C 


IC/188:01-08-91XEXP/BD:9SARBMIACLASS:C NON-COMMERCIALX 


„ATEST APP: 
L TYPE:RENEUALEXISS/TDATE: 01-08-91Х0ЕЕІСЕ: SMOKXBATES:244KX 
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ref Î sesuws nummer | 


POSITIVE IDENTIFICATION: CII# 
LAFD DATA BASE AND рој SEARCH ONLY 
NAME IN SYSTEM: 
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в t. 


= А uli i M 
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POSITIVE IDENTIFICATION: CII# 
LAFD DATA BASE AND DOJ SEARCH ONLY 
NAME IN- SYSTEM: SAME AS ABUVE 


SENT BY: LVA 


= | О i 9 
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IH 

REN SEESESSESSSESSSSSSSESEISESEI DATE: Q2-Q7-94 TIME:&Q:54:19 — 
RESTRICTED-DU NOT USE FOR EMPLOYMENT, LICENSING OR CERTIFICATIUN PURPOSES 
ATTN:WINSTUN-BÜUKING-JAIL 


ке III MULTI STATE RECORD 


ЕЕС Бе 
ЕВІ 

DOB 

жек + 

ARR/DET/CITE: NAM: 21 

PAGE 002 


Q4-235-84 CAPD LOS ANGELES 


148 PC-UBSTRUCTS TS ІС OFFICER 


x ж ж ж 


ARR/DET/CITE: | мам:вг Doe] | ЗЕ 
10-13-90 CAPD LOS ANGELES | d 
CNT:Q1 
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THIS NCIC INTERSTATE IDENTIFICATION INDEX RESFONSE IS THE RESULT OF YOUR 
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МАМЕ d FR) NO. INQUIRY DATE 
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w w [| O | озш эю 
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WHERE AN INDIVIDUAL IS SENTENCED JUNE 1, 1981, DR LATER, ON MORE THAN - 
ONE CHARGE WITHIN А GUCKEL, THE SENTENCES HAY RE CONSIDERED TO БЕ us 
CONCURRENT UNLESS IDENTIEIED AS CONSECUTIVE. I 
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Memorandum 


To : SAC, DIVISION II (196B-NY-234993) (P) Date 2/18/94 
вона НИНЫ 


"c sal (саз) 


ы Јања 
World Wrestling Federation; 
TITAN SPORTS, INCORPORATED; 
STAMFORD, CONNECTICUT; 
FBW; 


b6 
b"7C 


ReNYmemo, dated 12/7/93. 


On 2/15 j tacted o BEN EDNY, b6 
telephone number concerning captioned case. b7C 


Presently, there is no restraining order in effect 
preventing the disposition of 1241 East Main Street, Stamford, 
Connecticut, or any notice of the Government’s claim filed 
against the premises indexed to appropriately land records. 


AUSA[ ^ ^ ]advised he would consult with AUSA | be 
EDNY-Forfeiture Unit, regarding this matter, but he BIC 
advised he was not particularly concerned about the disposition 
of the premises due to the fact he believed a forfeiture 
judgement could be obtained from other assets held by defendants. 


. ausal | requested a title search of the subject з 
premises. 
b6 
b7C 
/%6-ку-әз4293 - 34 
Q? 196B-NY-234993 (SA C-12 


1 - 196B-NY-234993 Sub F (SA 


KRW:cxk 
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FEDERAL BUREAU ОЕ INVESTIGATION 


3/1/94 


Date of transcription 


On March 1, 1994, SA was telephonically 
d by an individual who identifie as b6 


an employee of the WORLD WRESTLING FEDERATIO 


[ ]statea that[ — ]was calling а pay phone, 
and a peared to be ургу disturbed concerning ability\to 
disassociate from appointed lawyers of the WWF, 


specifically 
interrogated for 
and was told by Wy a О е 
directly, "that they will bully you." [ ^ . ]stated that[ “| 


only intent was to tell the truth, in that various lawyers from 
В ЖЕП еге annoyed at what[ - ]haa said. 


sA[ ]aavisea that aa. to obtain written 
authority to continue talking to oncernin ossible 
intimidation as a witness, and in fact instructed to 
obtain new counsel and have the new attorney contact either SA 
or the U.S. Attorney in the Eastern District of New York. 
SA Sked not to divulge any additional information 
at this time until that written waiver was obtained, yet 


being so upset advised that hone at the ed 
by attorney  ]and when onfronted got 
so angry that he threatened to almost strike 


went on to explain that[ is going to meet. 
with an attorney sometime tonight and he would havel — | cali SA 
o set up a meeting involving concerns. 


(telephonically) ‘ | . 
Investigation on _ 3/1/94 at New York, New York File # 196B-NY-234993 
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28, at 9 p.m. bumping” 
m episodes of “Cobra” 
ne at 4 p.m. start- 
i Alt, Chris Lemmon 
‘atrick Macnee will 
>with Hogan. 


have a TV show that 
ike a one-hour movie 
week. We've got five 
1 bucks on the 
., says Hogan, who 
оез his lead charac- 
f, RJ. "Hurricane" 
эт as “a hard-living, 
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co-stars Carol Alt and Chris Lemmon. 
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Subject 


22, 1994 


Date 
March 28, 1994 


To 
The File # 9201488 
Titan Sports, Inc. 


was intervj to[  ]recent 
communications with Special Agent of the FBI. Present 
for this int i e S/A and a 


stated th terminated ИШ attorney/ 
client relationship wit when [  ]iearnea that а 
federal trial subpoena had been issued requirin appearence; 
and because of previous treatmen attorneys 


during the grand jury investigation. escribed this 
treatment as abusive. 


According tol === نعل‎ to meeting with agents and 
prosecutors of the Unite ates Attorneys i was 
questioned for at a cost to 


Titan Sports o complained 


[aia not believe that] _ testimony before the 


the sarca donic treatment by 


stated that 
i in Pennsylvania. 
said sarcastically 


т 


1 stated that[ |чав required to sign а " 
agreement allowing attorneys to advise Titan Sports off] 


statements to the government before Titan would agree to pay for 
representation. ' E 


attorneys 


i^ 


^on m 


` —..... that the Pennsylvania law relating to 


the selection of ring side medical personnel was based on a 1988 
"Sunset Performance Audit" of the Athletic Commission. This audit 


contained a derogatory paragraph about the state medical board. b6 
Thus, the law was changed to remove the state from being involved ÞIG 
in the selecti i side medical personne 
Furthermope| [recalled that it was 

assistant, that ordered 


at the Pennsylvania Arena exhibition. 


Additionally stated that recently had 


Separate conversations with two road agents of Titan Sports who a 


advised that they had testified falsely before the federal 
rand ju i 
Finally, expressed some concern about < 
cross-examinin at the trial of Titan Sports an 56 
said that ith ТА 


on matters relating to 


(— ORE T c E P 
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road agent with whom 


declined to provide the name of the other bé 
had this conversation. However, based b7C 
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Date 3/29/94 


TO FBI LABORATORY 


атты: [ROOM 3287 


FROM DADIC, NEW YORK (196B-NY-234993) (C-12) (P) 


š a WORLD WR G FEDERATION (WWF); 


FBW; MF; 
OO: NY 


Enclosed for the Laboratory under separate cover is 
one vial of NANDROLONE DECANOATE dated 3/22/93. 


For information of the Laboratory, captioned 
subject was indicted for distribution of steroids on 11/18/93 
in the Eastern District of New York. Ас part of the evidence 
in the case, the NY 
cooperating witness 


y when a noted urologist DR. 
ZAHORIAN was indicted by FBI in Pittsburgh Division in 1991. 


New. York has no reason to believe о E the contents 
of the questioned vial are < ids becaus[ j] 
routinely placed orders for and the ышы ыны REDE 
on the vial match with the orders fro 
the label originator of the vial. he United States 
Attorney's Office must make discovery to the defense counsel; 


the results should have been turned over to the defense 
counsel on January 4, 1994. 


2 - FBIHQ (Encl. under separate cover) 223 
@ - New York (196B-NY-234993) /81,8 - n! — 2344 


WMF:msc 
pommes 
(3) Searched 


Serialized ДӘ. 
Indexed 
ا‎ A 


Approved: Transmitted : Per 


(Number) (Time) 


= ó © 


It is requested that the Laboratory verify the 
contents of the 3/22/93 vial and submit results as soon as 


ossible, via Telefax, to Assistant United States Attorney be 
Brooklyn, New Y nc 
EE number elephone. number | 


А LABORATORY A 
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To: ADIC, New York Date: March 30, 1994 


FBI File No. 196B-NY-234993 


Lab No. 40329031 S TD 


Reference: Communication dated March 29, 1994 


Your N. 196B-NY-234993 


Re: 


dba WORLD WRESTLING 
FEDERATION (WWF) ; 


FBW; MF b7C 


OO: New York 


; Specimens received: March 29, 1994 
Specimens: 
Q1 Liquid in nandrolone decanoate vial 


Results of examination: 


The liquid in specimen Q1 contains nandrolone 


decanoate. The vial was received in a sealed condition. 


Specimen Q1 will be returned to your office by 
registered mail. 
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UNITED STATES _______ COURT 


EASTERN District of ____NEW ХОВК_____ 


THE UNITED STATES OF AMERICA ` 


95. 


VINCENT McMAHON, JR. and TITAN SPORTS, INC., 
—-—---4/Ъ/а "World Wrestling Federation" 
Defendants. 


SUPERS EDING 
INDICTMENT 

(T. 18, U.S.C.,§§371, 2 and 3551, et seq.; 

T. 21, U.S.C., $$ 333(e)(1)). mm 


A true bill. 


SEAN F. O'SHEA, AUSA 
(718) 330-2869 


DH:SFO:st 
F. £9201488 
TITANSUP.IND 


UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 


=- = = — — — — - - - - — — — nc c x 
UNITED STATES OF AMERICA 
- against - 
Cr. No. CR 93-1276(S) (JM 

VINCENT McMAHON, JR. and (T. 18, U.S.C., SS 371, 2 
TITAN SPORTS, INC., and 3551, et seq.; T. 21, 

d/b/a "World Wrestling U.S.C., SS 333(e) (1)) 

Federation," 

Defendants. 

-----.-.-....-........ x 


THE GRAND JURY CHARGES; 


NTRODUCTION TO L COUNTS 

1. From in or about 1984 until the date of the filing 
of this indictment, the defendant VINCENT K. McMAHON, JR. has 
been the Chief Executive Officer and sole owner of the defendant 
TITAN SPORTS, INC. (hereinafter "TITAN"). 

2. At all times relevant to this indictment, TITAN, 
doing business as the "World Wrestling Federation" (hereinafter 
"WWF"), operated an entertainment and sports business presenting 
professional wrestling exhibitions throughout the United States 
and around the world. WWF featured wrestling performers whose 
physiques were characterized by unusually large and well-defined 
muscles. 

3. The United States Food апа Drug Administration 
(hereinafter "FDA") is the federal agency charged with the 


responsibility of protecting the health and safety of the 


O Q 


4 


American public by ensuring that drugs are safe and effective 
before they may be manufactured and dispensed. FDA is also 
responsible for ensuring that approved drugs are manufactured and 
stored under conditions designed to promote their safety and 
effectiveness; that approved drugs are properly labeled to inform 
the public of medically approved usage; and that prescription 
drugs, because of their potential toxicity and harmful side 
effects, are distributed to individuals for use only when such 
use is supervised by a licensed medical practitioner acting 
within a legitimate doctor-patient relationship. 

4. Anabolic, androgenic steroids (hereinafter 
"Steroids") are chemical derivatives of testosterone, the male 
Sex hormone. At all times relevant to this indictment, steroids 
have been classified as prescription drugs by the FDA. 

5. Certain athletes and body-builders determined that 
Steroids can increase muscle development and can enhance athletic 
performance and physical appearance. However, the FDA has not 
approved the use of steroids to enhance athletic performance or 
physical appearance. Because of the legal limitations on access 
to steroids, various other sources developed which circumvented 
the regulatory controls enforced by the FDA, principally unlawful 
and unregulated sales of steroids by unauthorized distributors 
and licensed physicians who prescribed steroids for purposes 
other than the treatment of disease. 

6. In 1988, in response to increased incidents of 


illegal steroid distribution to athletes, Congress enacted 


O O 


3 


legislation specifically prohibiting the possession with intent 


to distribute, and the distribution of, steroids for any purpose 
other than the treatment of disease in humans. 

7. George T. Zahorian, III, named herein as an 
unindicted Co-conspirator, at all times relevant to this 
indictment was an osteopathic surgeon licensed in the state of 
Pennsylvania. “Throughout the 1980s, Zahorian was assigned to 
attend WWF exhibitions in Pennsylvania by the Pennsylvania 
Athletic Commission. Zahorian, with McMAHON's knowledge and 
approval, distributed steroids to wrestlers who performed at WWF- 
Sponsored exhibitions. 

8. In 1989, the Pennsylvania Athletic Commission 
deregulated wrestling and no longer assigned Commission doctors 
to attend wrestling exhibitions, but only required the presence 
of a licensed physician to be paid by the promoter. Following 
this deregulation, in 1989 Zahorian appeared at a WWF exhibition 
and was paid by TITAN for his appearance. Later still in 1989, 
TITAN engaged Zahorian to be the attending doctor at another WWF 
exhibition to be held in Hershey, Pennsylvania. Before the event 
took place, however, TITAN officials, including MCMAHON, learned 
of a federal investigation into Zahorian's activities, warned him 
of the investigation, and prevented him from appearing at that 


exhibition and any future WWF exhibition. 


COUNT ONE 
(Conspiracy) 


9. Paragraphs 1 through 8 of this indictment are 
hereby realleged апа incorporated as if fully set forth herein. 

10. From in or about 1985 until in or about February 
1991, both dates being approximate апа inclusive, within the 
Eastern District of New York and elsewhere, the defendants 
VINCENT K. McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World 
Wrestling Federation," together with others including George T. 
Zahorian, III, did knowingly and intentionally conspire to 
defraud the United States and to commit offenses against the 
United States, namely: 

a. to defraud the United States, in particular, 
the FDA, by impairing, impeding and defeating its 
efforts to regulate and control the manufacture and 
distribution of steroids within the United States, in 
violation of Title 18, United States Code, Section 371; 

b. to introduce and deliver for introduction 
into interstate commerce, with the intent to defraud 
and mislead, drugs that were misbranded within the 
neaning of Title 21, United States Code, Section .353 (b) 
in that the drugs were prescription drugs distributed 
without a prescription, in violation of Title 21, 
United States Code, Sections 331(a) and 333(a) (2) 


(formerly Title 21, United States Code, Section 
333(b)); 


О Q 
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С» to cause, with intent to defraud and mislead, 
the misbranding of drugs within the meaning of Title 
21, United States Code, Section 353(b) while such drugs 
were being held for sale, in that the drugs were 
prescription drugs distributed without a prescription, 
in violation of Title 21, United States Code, Sections 
331(k) and 333 (a) (2) (formerly Title 21, United States 
Code, Section 333 (b)); and 

d. to knowingly distribute and possess with 
intent to distribute steroids for use in humans other 
than the treatment of a disease pursuant to the order 
of a physician, in violation of Title 21, United States 
Code, Section 333(e)(1). 

11. An object of the conspiracy was unlawfully to 
provide WWF wrestling performers with steroids to enhance their 
Size and musculature, and thereby to increase the ticket sales 
for WWF exhibitions and the profits to TITAN and McMAHON. 

12. In furtherance of the conspiracy and to effect the 
objects thereof, within the Eastern District of New York and 
elsewhere, the defendants TITAN and McMAHON and others committed 
the following: 

OVERT ACTS 
a. On several occasions in or about and between 
1985 and February 1991, Zahorian ordered, paid for and received 
shipments of steroids, including but not limited to Nandrolone 


Decanoate (commonly known as "Deca") from a pharmaceutical 


O O 


company located in Westbury and Rockville Centre, Long Island, 
New York. 

b. on several occasions in or about and between 
1985 and February 1991, Zahorian distributed steroids to WWF 
wrestling performers at exhibitions and via express delivery 
shipments. 

c. On several occasions 1п or about and between 
1985 and February 1991, TITAN presented wrestling exhibitions at 
the Nassau Veterans Memorial coliseum in Uniondale, Long Island, 
New York. 

d. On several occasions in or about and between 
March 1988 and October 1989, McMAHON ordered and caused to be 
ordered Nandrolone Decanoate from Zahorian. 

e. On several occasions in or about and between 
March 1988 and October 1989, to evade the detection of these 
transactions, McMAHON utilized TITAN funds or resources to cause 
the purchase of bank checks which were then used to pay Zahorian 


for shipments of Nandrolone Decanoate. 


f. On several occasions in or about and between 
March 1988 and October 1989, McMAHON distributed and caused to be 
distributed Nandrolone Decanoate to a WWF performer known to the 
Grand Jury. 

g. During the period from in or about August 
1989 to in or about November 1989, TITAN executives instructed an 


employee of TITAN Known to the Grand Jury to hire Zahorian as the 


. O О 


attending doctor at а WWF exhibition to be held in Hershey, 
Pennsylvania in December 1989. 

h. On or about December 1, 1989, a TITAN 
executive known to the Grand Jury sent a memorandum to another 
TITAN executive known to the Grand Jury discussing the fact that 
Zahorian was under investigation and instructing the executive 
(i) to ensure that Zahorian did not attend an upcoming TITAN 
exhibition and (ii) to warn Zahorian of the existence of the 
investigation. 

i. In or about December 1989, McMAHON and a 
TITAN executive known to the Grand Jury discussed informing 
Zahorian that he was under investigation by law enforcement 
authorities. 

j- In or about December 1989, a TITAN executive 
known to the Grand Jury had a telephone conversation with 
Zahorian and directed him to destroy any records of Zahorian's 
contact with WWF or WWF wrestling personnel. 

k. In or about March 1990, McMAHON had a 
conversation with a WWF performer known to the Grand Jury. 

l. On or about January 25, 1991, McMAHON 
instructed all WWF wrestlers using steroids to carry a 
prescription for such steroids at all times. 

| m. In or about February 1991 McMAHON had a 
conversation with an attorney about ownership of steroids found 


in a hotel room and turned over to law enforcement authorities in 


Maryland. 


: ° 


8 
(Title 18, United States Code, Sections 371 and 3551 et 


COUNT TWO 
(Possession With Intent To Distribute Anabolic Steroids) 


13. Paragraphs 1 through 8 of this indictment are 
hereby realleged and. incorporated as if fully set forth herein. 
14. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendant TITAN SPORTS, 
INC., d/b/a "World Wrestling Federation," together with others 
including George T. Zahorian, III, did knowingly and 
intentionally possess with intent to distribute to Vincent K. 
McMahon, Jr. a substance containing anabolic steroids for use in 
humans other than for the treatment of disease pursuant tó the 
order of a physician. 
(Title 18, United States Code, Sections 2 and 3551 et 
Sed.; Title 21, United States Code, Section 333 (e) (1)). 
COUNT THREE 
(Possession With Intent To Distribute Anabolic Steroids) 
15. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
16. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendants VINCENT K. 
McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World Wrestling 
Federation," together with others including George T. Zahorian, 
III, did knowingly and intentionally possess with intent to ` 


distribute to a WWF performer Known to the Grand Jury a substance 


0 © 


9 
containing anabolic steroids for use in humans other than for the 
treatment of disease pursuant to the order of a physician. 

(Title 18, United States Code, Sections 2 and 3551 et 


seq.; Title 21, United States Code, Section 333(е)(1)). 
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A. Complaint / Information / Indictment 
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Serial number (A (5 - (27€ (Sor 


Check if Civil / Rico Complaint [7] 


. Arrest / Locate / Summons 
Arrest 
D Federal 0 Local + 
Subject Priority: ПА OB OC 
LJ Subject Resisted 
DJ Subject was Armed 
Locate 
Subject Priority: OA (38 ОС 
Summons 
0 Federal C) Local + 


. Hostage(s) Released 


Released by: ГІ Terrorists [] Other 
Number of Hostages: 


H. Final Judicial Process 


Conviction 

Also Complete Section I 

Date of Complaint, Information or Indictment: 
Date of Conviction: f/f ___ . 
Date of Sentence:__/ n 
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Judicial State: District: 
Sentence ре, X* 
Sentence Term: 


Suspended Probation 
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Fines: $ 


Tita Moers we, 392 ° 
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* See codes on reverse side. 


Restitution 
C) Court Ordered 
C) Pretrial Agreement 
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Мате Î DateofBitth Place of Birth (if available) Filed — 


нік | ni 


D. Recovery / Restitution / Potential Economic Loss Prevented (PELP) x € 
. Recovery 


Federal O Local 


. Civil / Rico Matters 
Also Complete Section I 
Date of Complaint: —  /.— / 
Judgment , .  * 
Judicial Outcome __ X * 
Fines: $ 


Suspension: 


I. U.S. Code Violations 


ie | зев [ com | 
LAENEN 


Required for Sections A, E, and H (Conviction) 
Optional for Section B (arrest) 


Lnd 

D Federal 

O Local ¢ 

[Г] Felony 

[O Misdemeanor 
O Plea 

O Trial 


O Subject Related to an LCN, Asian Organized Crime (AOC), or Italian Organized Crime (IOC) Group. (if checked, also submit form FD-515a) 


Ó From: 42< 


Investigative Assistance or Technique Used 
1 = Used, but did not help 


Swat Team Action 


G. Administrative Sanctions 


Subject Description Code: _ * 


Acquittal / Dismissal / Pretrial Diversion 
Date of Indictment or Information: / / 


Subject Description Code: TGZ- му- 23449 3 е 


Report Date; Í. / Š ; BAA 
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3 = Helped, substantially 
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CJ Injunction 
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04/06/94 ***** Indictment Information ***** FAAMAAO1 
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Case File Number. . : NY0234993 196B (SN) 
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PF11=Right PF12=Main 


48 МОМ = 32 
Scrolling performed 
04/06/94 ***** Indictment Information ***** FAAMAAO2 
« 1 more SENSITIVE / UNCLASSIFIED 3 more > 
File Nbr . . : NY0234993 196B (SN) 
Field Office . . : NY Rpt Date . . : 04/06/1994 
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Serial Number of FD-515. ЕРА‏ 


SOC Agent Claiming Stat. . ГІ 
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Task Force s a: ua ж x» Q у е D ace ce + 
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Classified By: 
SENSITIVE / UNCLASSIFIED Declassify ‘On: 
PFl-Help PF3=Exit PF4=Pmpt PF5-Indx PF7=Bkwd PF8-Fwd PF9=Quit PF10-Left 
PFli-Right PF12-Main 
40% NUM س‎ 32 
Scrolling performed 
04/06/94 ***** Indictment Information ***** FAAMAA04 
< 2 more SENSITIVE / UNCLASSIFIED 2 more > 
Field Office . NY File Nbr . . : NY0234993 196B (SN) 


RA/Squad Code. . Rpt Date . . 04/06/1994 

SOC $tat Agnt. . rss. i Stat Agnt. . 

Subject. . . > INC (SN) 
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04/06/94 ***** Indictment Information ***** FAAMAA21 
« 3 more SENSITIVE / UNCLASSIFIED 1 more » 
Field Office . . : NY File Nbr . . : NY0234993 196B (SN) 
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TIT2SUP.IND 
UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 44247 
- = — = we =< е. < = =< =< =< — — ч» A x 
UNITED STATES OF AMERICA SUPERSEDING 
INDICTMENIT 
- against - 
Cr. No. СЕ 93-1276(S-2) (JM 
VINCENT McMAHON, JR. and (T. 18, U.S.C., SS 371, 
TITAN SPORTS, INC., and 3551, et seg.; T. 2 
d/b/a "World Wrestling U.S.C., S 333 (e) (1)) 
Federation," 
Defendants. 
Ó =< ғы «в = «в = = = = E = - x 


THE GRAND JURY CHARGES: 
TNTRODUCTION TO ALL COUNTS 

3. From in or about 1984 until the date of the.filing 
of this indictment, the defendant VINCENT K. McMAHON, JR. has 
been the Chief Executive Officer and sole owner of the defendant 
TITAN SPORTS, INC. (hereinafter "ТІТАМ"). 

2% At all times relevant to this indictment, TITAN, 
doing business as the "World Wrestling Federation" (hereinafter 
"WWF"), operated an entertainment and sports business presenting 
professional wrestling exhibitions throughout the United States 


and around the world. WWF featured wrestling performers whose 


physiques were characterized by unusually large and well-defined 


muscles. 

35 The United States Food and Drug Айии сга нече 
(hereinafter "FDA") is the federal agency charded with ERa" | ] 
responsibility of protecting the health and safety df thé 2 | 
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1, 
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American public ру ensuring that drugs are safe and effective 


before they may be manufactured and dispensed. FDA is also 
responsible for ensuring that approved drugs are manufactured and 
stored under conditions designed to promote their safety and 
effectiveness; that approved drugs are properly labeled to inform 
the public of medically approved usage; and that prescription 
drugs, because of their potential toxicity and harmful side 
effects, are distributed to individuals for use only when such 
use is supervised by a licensed medical practitioner acting 
within a legitimate doctor-patient relationship. 

4. Anabolic, androgenic steroids (hereinafter 
"Steroids") are chemical derivatives of testosterone, the male 
sex hormone. At all times relevant to this indictment, steroids 
have been classified as prescription drugs by the FDA. 

5» Certain athletes апа body-builders determined that 
steroids can increase muscle development and can enhance athletic 
performance and pha cau BEER However, the FDA has not 
approved the use of steroids to enhance athletic performance or 
physical appearance. Because of the legal limitations on access 
to steroids, various other sources developed which circumvented 
the regulatory controls enforced by the FDA, principally unlawful 
and unregulated sales of steroids by unauthorized distributors 
and licensed physicians who prescribed steroids for purposes 
other than the treatment of disease. 

6. In 1988, in response to increased incidents of 


illegal steroid distribution to athletes, Congress enacted 


О 


legislation specifically prohibiting the possession with intent 
to distribute, and the distribution of, steroids for any purpose 
other than the treatment of disease in humans. 

Te George T. Zahorian, III, named herein as an 
unindicted co-conspirator, at all times relevant to this 
indictment was an osteopathic surgeon licensed in the state of 
Pennsylvania. Throughout the 1980s, Zahorian was assigned to 
attend WWF exhibitions in Pennsylvania by the Pennsylvania 
Athletic Commission.  Zahorian, with McMAHON's knowledge and 
approval, distributed steroids to wrestlers who performed at WWF- 
Sponsored exhibitions. 

8. In 1989, the Pennsylvania Athletic Commission 
deregulated wrestling and no longer assigned Commission doctors 
to attend wrestling exhibitions, but only required the presence 
of a licensed physician to be paid by the promoter. Following 
this deregulation, in 1989 Zahorian appeared at a WWF exhibition 
and was paid by TITAN for his appearance. Later still in 1989, 
TITAN engaged Zahorian to be the attending doctor at another WWF 
exhibition to be held in Hershey, Pennsylvania. Before the event 
took place, however, TITAN officials, including McMAHON, learned 
of a federal investigation into Zahorian's activities, warned him 
of the investigation, and prevented him from appearing at that 


exhibition and any future WWF exhibition. 
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COUNT ONE 
(Conspiracy) 


9. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 

10. From in or about 1985 until in or about February 
1991, both dates being approximate and inclusive, within the 
Eastern District of New York and elsewhere, the defendants 
VINCENT K. MCMAHON, JR. and TITAN SPORTS, INC., d/b/a "World 
Wrestling Federation," together with others including George Т. 
Zahorian, III, did knowingly and intentionally conspire to 
defraud the United States and to commit offenses against the 
United States, namely: 

a. to defraud the United States, in particular, 
the FDA, by impairing, impeding and defeating its 
efforts to regulate and control the manufacture and 

-distribution of steroids within the United States, in 
violation of Title 18, United States Code, Section 371; 

b. to introduce and deliver for introduction 

into interstate commerce, with the intent to defraud 


and mislead, drugs that were misbranded within the 


meaning of Title 21, United States Code, Section 353(b) 


in that the drugs were prescription drugs distributed 
without a prescription, in violation of Title 21, 
United States Code, Sections 331(a) and 333(a)(2) 


(formerly Title 21, United States Code, Section 


333 (b)); 


© О 
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с. to cause, with intent to defraud апа mislead, 
the misbranding of drugs within the meaning of Title 
21, United States Code, Section 353(b) while such drugs 
were being held for sale after shipment in interstate 
commerce, in that the drugs were prescription drugs. 
distributed without a prescription, in violation of 
Title 21, United States Code, Sections 331(k) and 
333(a)(2) (formerly Title 21, United States Code, 
Section 333(b)); and 

d. to knowingly distribute and possess with 
intent to distribute steroids for use in humans other 
than the treatment of a disease pursuant to the order 
of a physician, in violation of Title 21, United States 
Code, Section 333(e)(1). 

11. An object of the conspiracy was unlawfully to 
provide WWF wrestling performers with steroids to enhance their 
size and musculature, and thereby to increase the ticket sales 
for WWF exhibitions and the profits to TITAN and MCMAHON. 

12. In furtherance of the conspiracy and to effect the 
objects thereof, within the Eastern District of New York and 
elsewhere, the defendants TITAN and McMAHON and others committed 
the following: 

OVERT ACTS 
a. On several occasions in or about and between 
1985 and February 1991, Zahorian ordered, paid for and received 


shipments of steroids, including but not limited to Nandrolone 
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6 
Decanoate (commonly known as "Deca") from a pharmaceutical 
company located in Westbury and Rockville Centre, Long Island, 
New York. 
b. On several occasions in or about and between 


1985 and February 1991, Zahorian distributed steroids to WWF I 
wrestling performers at exhibitions and via express delivery 
shipments. 

es. On several occasions in or about and between 
1985 and February 1991, TITAN presented wrestling exhibitions at 
the Nassau Veterans Memorial Coliseum in Uniondale, Long Island, 
New York. 

d. On several occasions in or about and between 
March 1988 and October 1989, McMAHON ordered and caused to be 
ordered Nandrolone Decanoate from,Zahorian. 

e. On several occasions in or about and between 
March 1988 and October 1989, to evade the detection of these 
"transactions, McMAHON utilized TITAN funds or resources to cause 
the purchase of bank checks which were then used to pay Zahorian 
for shipments of Nandrolone Decanoate. 

£. on several occasions in or about and between 
March 1988 and October 1989, MCMAHON distributed and caused to be 
distributed Nandrolone Decanoate to a WWF performer Known to the 
Grand Jury. 

g. During the period from in or about August 
1989 to in or about November 1989, TITAN executives instructed an 


employee of TITAN known to the Grand Jury to hire Zahorian as the 
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attending doctor at a WWF exhibition to be held in Hershey, 
Pennsylvania in December 1989. 

h. On or about December 1, 1989, a TITAN 
executive known to the Grand Jury sent a memorandum to another 
TITAN executive known to the Grand Jury discussing the fact that 
Zahorian was under investigation and instructing the executive 
(i) to ensure that Zahorian did not attend an upcoming TITAN 
exhibition and (ii) to warn Zahorian of the existence of the 
investigation. 

i. In or about December 1989, McMAHON and a 
TITAN executive known to the Grand Jury discussed informing 
Zahorian that he was under investigation by law enforcement 
authorities. 

3. In or about December 1989, a TITAN executive 
known to the Grand Jury had a telephone conversation with 
Zahorian and directed him to destroy any records of Zahorian's 
contact with WWF or WWF wrestling personnel- 

k. In or about March 1990, McMAHON had а 
conversation with a WWF performer known to the Grand Jury. 

l. On or about January 25, 1991, MCMAHON 
instructed all WWF wrestlers using steroids to carry a 
prescription for such steroids at all times. 

m. In or about February 1991 McMAHON had a 
conversation with an attorney about ownership of steroids found 
in a hotel room and turned over to law enforcement authorities in 


Maryland. 
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(Title 18, United States Code, Sections 371 and 3551 et 
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COUNT TWO 
(Possession With Intent То Distribute Anabolic Steroids) 


13. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
14. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendant TITAN SPORTS, 
INC., d/b/a "World Wrestling Federation," together with others 
including George T. Zahorian, III, did knowingly апа 
intentionally possess with intent to distribute to Vincent K. 
McMahon, Jr. a substance containing anabolic steroids for use in 
humans other than for the treatment of disease pursuant to the 
order of a physician. 
(Title 18, United States Code, Sections 2 and 3551 et 
seq.; Title 21, United States Code, Section 333(е)(1)). 
COUNT THREE 
(Possession With Intent To Distribute Anabolic Steroids) 
15. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
16. On or about October 24, 1989, within the Eastern 
District of New York and elsewhere, the defendants VINCENT K. 
McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World Wrestling 
Federation," together with others including George T. Zahorian, 
III, did knowingly and intentionally possess with intent to 


distribute to a WWF performer known to the Grand Jury a substance 
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9 
containing anabolic steroids for use in humans other than for the 
treatment of disease pursuant to the order of a physician. 

(Title 18, United States Code, Sections 2 and 3551 et 


seq.; Title 21, United States Code, Section 333(e)(1)). 


COUNT -FOUR 
(Possession With Intent To Distribute Anabolic Steroids) 


17. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
18. On or about April 13, 1989, within the Eastern 
District of New York and elsewhere, the defendant TITAN SPORTS, 
INC., d/b/a "World Wrestling Federation," together with others 
including George T. Zahorian, III, did knowingly and 
intentionally possess with intent to distribute to Vincent K. 
McMahon, Jr. a substance containing anabolic steroids for use in 
humans other than for the treatment of disease pursuant to the 
order of a physician. 
(Title 18, United States Code, Sections 2 and 3551 et 
seq.; Title 21, United States Code, Section 333(e)(1)). 
COUNT FIVE 
(Possession With Intent To Distribute Anabolic Steroids) 
19. Paragraphs 1 through 8 of this indictment are 
hereby realleged and incorporated as if fully set forth herein. 
20. On or about April 13, 1989, within the Eastern 
District of New York and elsewhere, the defendants VINCENT K. 
McMAHON, JR. and TITAN SPORTS, INC., d/b/a "World Wrestling 


Federation," together with others including George T. Zahorian, 


O Q 


III, did knovingly and intentionally possess with intent to 
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distribute to a WWF performer known to the Grand Jury a substance 
containing anabolic steroids for use in humans other than for the 
treatment of disease pursuant to the order of a physician. 

(Title 18, United States Code, Sections 2 and 3551 et 


seq.; Title 21, United States Code, Section 333(e)(1)). 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


MM RD QE Date: 02/11/2010 
To: | CIRG Attn: SEMU 
= 
Ж P Л] 
All Field Offices Attn: Special eu Coordinators : 
Phoenix FIG 


From: Phoenix 
NS-3 


Contact: = 


Approved By: 


Drafted By: :tjh ڪڪ‎ = 


Case ID #: 300A-PX- (Pending) 
300A-HQ-C1434728-PX (Pending) 


Title: WORLD WRESTLING ENTERTAINMENT - WRESTLEMANIA XXVI; 
UNIVERSITY OF PHOENIX STADIUM - GLENDALE, ARIZONA 
MARCH 25-29, 2010 


Synopsis: Open captioned matter. Phoenix is requesting receiving 
offices canvass for positive threat information regarding the 
listed event. 


Details: Оп 03/25/2010 through 03/29/2010, the University of 
Phoenix Stadium, Glendale; Arizona will host World Wrestling 
Entertainments's (WWE) Wes lemania XXVI. 


Wrestlemania is expected to draw over 100,000 
professional wrestling enthusiasts to the valley. This event will 
also be attended by a multitude of VIPs, celebrities and 
professional athletes. It is expected that over a million pay per 
view telecasts will be sold worldwide and covered by a host of 
local, national, and international media, 


In addition to Wrestlemania, a large number WWE 
sponsored side events will be held at various sites in the 
Phoenix Metropolitan area. 


UNCLASSIFIED 


зо 7H. Ec. 


< 4 


To: CTRG From: O: 
Re: 300A-PX-84803, 03/30/2010 


LEAD (s): 
Set Lead 1: (Info) 
COUNTERTERRORISM 
AT SEMU 


For information. Read and clear. 


++ 
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To: CIRG From: Phoenix 
Re: 300A-PX-NEW, 02/11/2010 


Special Events Data Call Questionnaire 
(October 18, 2007 Version) 
(1) Event Name: World Wrestling Entertainment - Wrestlemania 
(2) City: University of Phoenix Stadium and various Valley locations 
(3) State: Arizona 
(4) Zip Code: NA 
(5) In a UASI region? Yes, Phoenix/Mesa Metropolitan area 


(6 


МУ 


Start date: March 25, 2010 
(7) End date: March 29, 2010 


(8) Event type: 
- Entertainment venue and indoor event 


(9) Event Sponsor: 
- World Wrestling Entertainiment 


(11) Law Enforcement POC: 
- TFO 


(12) Law Enforcement POC Tel: 
(13) Law Enforcement POC e-mail: 
ic.fbi.gov 


(14) Annual event? 
- YES 


(15) Peak Estimated Attendance: 
- 100,000 


(16) Peak Attendance Justification: 
- Based upon last years attendance 


(17) Total estimated attendance: ranges from 400,000 - 550,000 (maximum scenario) 


(18) Significance: 
І - Рау рег view televised event 


(19) Dignitary Attendance: 


UNCLASSIFIED 
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ө UNCLASSIFIED 
To: CIRG From: Phoenix 
Re: 300A-PX-NEW, 02/11/2010 
- Not known at this time 


(20) Dignitary List: 
- Not known at this time 


(21) Media Coverage: 
- local, national and international coverage 


(22) Capabilities: 
- Event Requirements Easily Met by Capabilities 


(23) Event Significance/Scope: 
- National 


(24) Event Significance/Scope Comments: 


- largest attended entertainment event in the country. 


(25) Venue Significance: 
- Internationally significant 


(26) Venue's Primary Feature: 
y 
- Large exterior venue 


(27) Attachments: 
- None 


(28) Remarks: 
- None 


UNCLASSIFIED 


4 


Ф UNCLASSIFIED e 


To: CIRG From: Phoenix 
Re: 300A-PX-NEW, 02/11/2010 


LEAD(s): 
Set Lead 1: (Action) 
CIRG 


AT SEMU, VA 
Provide Phoenix Field Office with a ] bi 
for the listed event. 


Set Lead 2: (Discretionary) 


tz 


ALL RECEIVING OFFICES 


Forward positive intelligence regarding Wrestlemania, 
from sources with knowledge of planned activity by individuals, 
domestic or international groups under open Preliminary or Full 
investigations, as well as intelligence from any source 
indicative of unlawful activity or other acts of violence to TFO 


Set Lead 3: (Action) 


PHOENIX 
AT FIG 
Requst тА[  ]eenauct a Threat Assessment for 
this event and coordinate results with TFO for the 


dissemination to both state and local officials. 


++ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 3/4/2010 


To: Phoenix Attn: ASAC 
SSA 
TFO 


specia. Event Coordinator 


Intelligence Directorate Attn: С 


Production Services Unit (PSU) Lë 


bic 
From:  CIRG 
Special Events Management Unit (SEMU 
Contact: 
Drafted By: [ ^7 ^ Z7  ]mwm 
Case ID d: 300A-IR-8320-PX (Pending) 
300A-PX- 84803 (Pending) 
Title: WRESTLEMANIA XXVI 
UNIVERSITY OF PHOENIX STADIUM 
GLENDALE, ARIZONA 
3/25 - 3/29/2010 
CT PREPAREDNESS - SPECIAL EVENTS 
b7E 


Synopsis: To confirm receipt of Phoenix's electronic 
j to advise Phoenix of the 


communicat i ; 
for captioned event; to 
provide guidance on planning and preparation activities; to 


provide guidance in preparing a threat assessment; and to identify 
the SEMU point of contact for captioned event. 


Reference: 300A-PX-84803 Serial 1 


from Phoenix advising о e captioned special event. Phoenix 


provided background information about the upcoming Wrestlemania 
XXVI, which will take place on 3/25 - 3/29/2010, at the University 
of Phoenix Stadium, Glendale, Arizona. 


all domestic special events were assigned a 
designation in an attempt to 
j r events 


To: Phoenix аб) СІРС e 


Re: 300A-IR-8320-PX, 3/4/2010 


Special event coordinators/case agents should make 

appropriate recommendations to their respective Special Agent-in- 

SAC) on whether to open 300A cases on vents] 

based on specific threats to the event or specific 
requests for support for the event. Special Events are 
generally supported primarily by state and local agencies with 
participation by the FBI as deemed appropriate by the local FBI 
field office. Augmentation of regources by additional FBI assets 
is generally not considered for З j However, should 
Phoenix identify a need for specific support, an EC with full 
justification should be submitted to the SEMU. The SEMU will then 


coordinate the requested support with the appropriate program 
managers at FBIHO. 


Scheduled overtime for special agents assigned to work 
special events will be approved under certain very limited and 
relatively rare circumstances. In accordance with a memorandum to 
all SACs, dated January 1, 1999 (referenced EC: 66F-HQ-A1240026- 
PA, Serial 72) all requests for scheduled overtime for special 
agents must be submitted as far in advance as possible to the 
Deputy Director for approval. If scheduled overtime is 
contemplated, affected field offices or LEGATs must notify 
FBIHQ/SEMU immediately for guidance. 


The Directorate of Intelligence (DI) has set forth a 
new policy to all field offices which provides guidance and 
procedures regarding the role of field intelligence groups (FIGs) 
in finished intelligence production. This new policy delegates 
the responsibility for prepari i event threat assessments 
(SETAs) to the field offices events within their 
territories (referenced EC: 319W-HQ-A1487699-DI, Serial 5, dated 
6/29/2006). Field offices are not mandated to produce a SETA for 


To: Phoenix тоб) СІРС Ф 


Re: 300A-IR-8320-PX, 3/4/2010 


Specific guidance for the preparation of SETAs is 
available from the DI and posted to the DI's intranet page under 
the Production Services Unit (PSU). In addition, see the 
Intelligence Production and Use CONOPs, Annex A: Support to 
Special Events, dated 2/1/2006, for detailed information regarding 
the FBI's intelligence responsibilities for special events at 


http://di.fbinet.fbi/conops. 


Further, SETAs will not include information regarding 
First Amendment protected activity such as demonstrations, 
protests, rallies, propagandizing, and recruiting. Such 
activities are not considered a "threat" to the event. It is 
imperative to follow the established FBI policy regarding the 
protection of civil liberties during the course of these events as 
stated in 62F-HQ-C1413697, Serial 30, dated 03/19/2004 and 66F-HQ- 
C1185963, Serial 826, dated 04/26/2004. For further guidance on 
this issue, please contact your Chief Division Counsel. 


FBIHO review and coordination of SETAs will be handled 
as expeditiously as possible. By EC dated 03/05/2007, 319W-HQ- 
A1487699-DI, Serial 43, the DI provided a new time-line for the 
production of SETAs.  SETAs should be completed and disseminated 
at least 10 working days prior to a planned event. 
Amendments/additions can then be made to the SETA up to three days 
prior to the event. Absent unusual circumstances, the PSU will no 
longer accept SETAs for prescheduled events later than 10 working 
days prior to the event, or in this case, a particular game. 
SETAs for unscheduled events (e.g. state funerals) should be 
submitted at least three days prior to the event, if possible. 
SETAs must be disseminated in a timely manner to provide threat 


information ith securing the event. In instances 
where event occurs very late, making it 
impossible СО suDbmi t least 10 days prior to the event, 


the threat assessment can be orally briefed to those tas 
securing the event, with the written product to follow. 


To: Phoenix D CIRG e 


Re: 300A-IR-8320-PX, 3/4/2010 


the field office has obtained threat information E‏ ]| ا 
specific to that event, PSU will expedite the review/approval‏ 
process as appropriate. Event coordinators are reminded to‏ 


regularly interact with the FIG so that SETAs can be produced in a 
timely manner. 


[ чу be reconciled with а closing EC detailing 
the event. оеп1х is requested to forward a closing EC to SEMU 


no later than 30 days following the conclusion ОЁ this event. 


Phoenix is asked to closely plan and coordinate its 
critical incident management activities with local, state, and 
federal agencies that are providing security and consequence 
management support for the captioned event. This should be the 
standard practice for any special event but it is even more 
critical in light of the ongoing war on terrorism and the 
potential for additional acts of terrorism being committed in the 
United States. 


Phoenix should also forward a copy of any 


security/response/operational plans for this event to CIRG/SEMU 
FBI Academy, Quantico, VA, 22135, to the attention of 


To: Phoenix „Ф СІРС @ 


Re: 300А-ТЕ-8320-РХ, 3/4/2010 


LEAD(s): 


Set Lead 1: (Action) 


Б Б 
ل ل‎ бу 
mo 


PHOENIX 
AT PHOENIX, ARIZONA 
1. If a SETA will be prepared in support of this 


Phoenix's FIG is requested to provide a copy of the SETA 
to UC PSU/DI, and the SEMU. 


2. If a SETA will not be prepared in support of this 
== 24) Phoenix should provide the SEMU with апу positive 
intelligence regarding unlawful activity or other acts of violence 


pertaining to this event. 


Set Lead 2: (Action) 
PHOENIX 

AT PHOENIX, ARIZONA 

1. Phoenix's Special Event Coordinator is requested to 
promptly submit any requests for FBIHQ resource augmentation 
required for this event with full justification. 

2. Phoenix's Special Event Coordinator is requested to 
forward a copy of any interagency crisis management/operations 
plans for this event tj] CIRG/SEMU, 
FBI Academy, Quantico, VA, 22135, and to submit a closing EC to 
SEMU within 30 days of conclusion of captioned event. 

Set Lead 3: (Info) 
PHOENIX 


AT PHOENIX, ARIZONA 


At Speci i :— Wrestlemania XXVI has 
been designated a 


To: Phoenix моб CIRG 
Re: 300A-IR-8320-PX, 3/4/2010 


Set Lead 4: (Info) 
INTELLIGENCE DIRECTORATE 
AT WASHINGTON, DC 


At PSU, read and clear. 
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ЗЕ e e 
OPERATIONS ORDER 
Phoenix Field Office Special Event 


FILE NUMBER: 300A-PX-84803 
Field Division/Squad: Phoenix, NS-3 


Date Prepared: 03/23/2010 Planned Date of Operation: 03/25/2010 thru 03/29/2010 


TITLE OF CASE: | WORLD WRESTLING ENTERTAINMENT WRESTLEMANIA XXVI 


UNIVERSITY OF PHOENIX STADIUM 


GLENDALE, ARIZONA 


MARCH 25 THRU 28, 2010 


Case Agent: TFO[ j] mé[ — ] | 
Assisting Agent: s | ЕТЕНЕ 


SITUATION/MISSION 


o бу 


NQ 


Type of Operation: Location of Activity: 


SPECIAL EVENT University of Phoenix Stadium 
Glendale, Arizona 


Special Event Information: 
On 03/25/2010 through 03/29/2010, the University of Phoenix Stadium, Glendale, Arizona will host World Wrestling 


Entertainments's (WWE) Westlemania XXVI. Wrestlemania is expected to draw over 100,000 professional wrestling enthusiasts to the 
valley. This event will also be attended by a multitude of VIPs, celebrities and professional athletes. It is expected that over a million 
pay per view telecasts will be sold worldwide and covered by a host of local, national, and international media. In addition to 
Wrestlemania, a large number WWE sponsored side events will be held at various sites in the Phoenix Metropolitan area. Considering 
the above, this event could be a target for domestic and/or internation: i is ti i itive information b7E 


regarding any possible threats. The listed event has been designated y the FBI 
Special Event Management Unit (SEMU) and suggests no additional government resources are needed. 


Mission Statement: 
The £1 priority of the FBI Counterterrorism Division is to disrupt, deter, and defeat a terrorist attack before it occurs. It is the 
priority of the Phoenix FBI Special Events personnel to insure that all intelligence information regarding possible terrorist activities at 
this event is uncovered, analyzed, and acted upon in a timely manner. It is also the goal of FBI personnel to insure that the proper 
liaison is established with the state and local officials responsible for first response to this event, the event management and security of 
this event, and any other agencies participating in the security of this event, so that an integrated plan of action regarding crisis 
management is in place should a terrorist threat or incident occur. In the event a threat or a terrorist incident occurs, it is the goal of 
the FBI to collect evidence and seek the prosecution of those individuals involved in the violation of federal statute. 


This Document has been prepared by the Federal Bureau of Investigation 


FOR LAW ENFORCEMENT USE ONLY 
LETSS/PAU ARREST PLAN FORM (01/01) SS А-1. 


|: OSLO т Š № .05 Pal 


SITUATION/MISSION CONTINUED 


INTELLIGENCE 


At this particular time, there is NO intelligence that would indicate that this particular event has been targeted by any domestic or 

international terrorist organization. NO threats have been received which would impact this event. However, it is important to note 
that events of this magnitude, particularly sporting events, have been known to draw the attention of terrorist organizations as targets 
of particular interest. Please refer to the Phoenix Division Special Event Threat Evaluation attached to this document. 


FBIJTTF/AcTIC/TLO PERSONNEL IN THE OPERATION 


А roster of personnel has been completed and will be distributed prior to the event. There groups referred to as 
Investigate Intelligence Teams (I&I Teams) will be made up exclusively of members of the FBI Joint Terrorism Task 
Force. Note: All personnel rosters are also subject to change. 


Stand-by 
S 


ACTIC Terrorism Liason Officers On scene PIR 


Other ЕВІ/УТТЕ Personnel 


Personnel who are not directly involved in the subject operation, but may support the overall mission. 
ЕУ eg 2. 
sA u [ 


ed‏ ڪڪ 
ا з= a‏ 
United States Attorney { ]‏ 


This Document has been prepared by the Federal Bureau of Investigation 
FOR LAW ENFORCEMENT USE ONLY 


LETSS/PAU ARREST PLAN FORM (01/01) A-2 


EXECUTION 


OVERALL SUMMARY OF PRIMARY PLAN 


js Special Event is designated J Event by the Department of Homeland Security/Special Events Section 

level is an internal FBI/DHS classification level which denotes the level of FBI/Federal resources required to 
adequately support the event. enotes that the event is adequately supported by state and local resources 
and ЕВ] involvement is at a minimum. 


In the event of a terrorist related threat/incident, TF will act as the FBI On-Scene Commander (OSC) until 
relieved by an SSA as designated by the Phoenix Special Agent-in-Charge (SAC). 


All other CRISIS MANAGEMENT/SWAT/WMD/BOMB/ERT personnel will be available for response as directed by 
FBI Phoenix policy. 


The Glendale Police Department (GPD) has primary law enforcement ET for Wrestlemania XXVI. The Event 


Security Coordinator and Glendale Police representative is Lieutenan| Other Agencies to 
include are members of the Arizona Department of Public Safety (DPS), Phoenix Police Department and the Glendale 
Fire Department. 


The City of Glendale is not requesting any augmentation or federal resources beyond the provided personnel. FBI 
Phoenix maintains an ongoing working relationship with each of these entities and is working closely with them for 
Crisis Management planning. 


This Document has been prepared by the Federal Bureau of Investigation 
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EXECUTION CONTINUED 


COORDINATING INSTRUCTIONS 


In the event of a terrorist incident, Phoenix FBI HQ, 201 E. Indianola, Phoenix, Arizona, 85012, 602-279-5511, will 
become the Joint Operations Center (JOC) for all investigation related activities. The Special Agent-in-Charge (SAC) of 
the Phoenix Division will become the Incident Commander for all investigation related activities. The On-Scene 
Commander (OSC) at the Stadium will be TFO Tim Hines, until relieved by the SAC, SSA or designated SA. All 
responding FBI Personnel will first contact the Phoenix FBI HQ JOC for instructions on where to respond. 


It should be noted that the role and responsibility of the FBI response to a terrorist threat or incident is clearly defined 
by a number of Federal documents to include Homeland Security Presidential Directive (HSPD) 5. 


The response of the FBI to a threat or incident is outlined in the United States Government National Response 
Framework (NRF). The FBI also receives guidance for response from the National Incident Management System 
(NIMS) plan and other pertinent federal documents. 


Succinctly stated, these documents give the Lead Federal Agency authority for criminal investigation of any terrorist 
threat or act, as well as the intelligence collection responsibility for intelligence collected within the United States, to the 
FBI. 


NOTE: 
Although the FBI is designated the Lead Federal Agency by Presidential Directive for investigations related to Terrorist 
investigations, it should not be construed that the On-site Incident Command will be taken over by the FBI. That 
responsibility will remain with the local or state Agency, designated by statute, responsible for first response. The FBI 
will have on-site representation in the FBI OSC but Incident Command will be retained by the appropiiate statutory 
authority until such time that it is appropriate to pass the On-site Incident Command to the FBI. This decision will be 
made jointly by the On-Site Incident Commander and the SAC Phoenix. 


CONTINGENCIES 


In the event that multiple terrorist incidents occur simultaneously in Arizona and include both the University of Phoenix 
Stadium and the FBI HQ's office in Phoenix, the alternate JOC for the FBI will be the Arizona Counter Terrorism 
Information Center, 16212 N. 28th Avenue, Phoenix, Arizona. 


A forward operating command post may be established at PPD HQ, located at 620 W. Washington, Phoenix, Arizona. 
(This location is approximately 20 miles east of PIR). 


This Document has been prepared by the Federal Bureau of Investigation 
FOR LAW ENFORCEMENT USE ONLY 


LETSS/PAU ARREST PLAN FORM (01/01) A-4 


SPECIFIC DUTIES 
ON-SCENE COMMANDER 


In the event of a terrorist threat or incident, Ted | as EBI OSC, will immediately respond to the Command post 
located at the venue, to meet with the Incident Commander, other key Law Enforcement officials, and venue/stadium 
officials. The purpose of this meeting will be to evaluate the situation and mobilize the necessary resources to resolve 
the situation. 


CRISIS MANAGEMENT 


In the event that a threat or incident requires the activation of the Crisis Management Unit of the FBI, ss | 

Crisis Management Coordinator, will be responsible for the appropriate Crisis Management response as 
desired by SAC Phoenix. The initial FBI Joint Operations Center (JOC) will be established at Phoenix FBI HQ with the 
appropriate liaison established with the Arizona Counter Terrorism Information Center (ACTIC). 


SPECIAL WEAPONS AND TACTICS (SWAT) 


In the event that a threat or incident requires the activation of the T Team, Senior SWAT Team Leader S 
ill insure a timely and appropriate SWAT response. S ill coordinat ju local tactical 


units responding to the crisis. The SWAT team will respond to a location as directed by S d stand-by for 


further instruction id 


WEAPONS OF MASS DESTRUCTION (WMD) f 


In the event that a threat or incident involves any type of WMD, sl — |; Coordinator, will coordinate 
the appropriate FBI response and will liaison with state and local responders per established protocols. 


In the event that a threat or incident requires the involvement of FBI Bomb Technicians, s þin liaison with 
state and local bomb technicians per established protocols. 


EMERGENCY RESPONSE TEAM (ERT) 


In the event that a threat or incident requires the activation of the ERT, s[ фт Team Leader, will 


inate with o insure a proper response. ERT personnel will respond to a location as directed by SA 
d stand-by for further instructions. There are approximate Palade for response. 


In the event that a threat or incident, S | Media Representative, will be responsible for coordinating the release 
of any information with along with the media representatives of the state and local agencies involved. SA han 
be responsible to insure that a Joint Information Center (JIC) is activated and that any media release serves the best 
interest of any ongoing investigation. 


This Document has been prepared by the Federal Bureau of Investigation 
FOR LAW ENFORCEMENT USE ONLY 


LETSS/PAU ARREST PLAN FORM (01/01) A-5 


SPECIFIC SKILLS CONTINUED 


In the event that a threat or inci i contact for the United States Attorney's Office (USAO) is Assistant 
United States Attorney (AUSA Should an incident occur where it is prudent that the USAO is 
immediately notified, AUS ill be contacted by either the OSC, the JTTF Supervisor, or the JOC. 


FBI DEADLY FORCE POLICY 


"Law Enforcement Officers of the Department of Justice may use deadly force only when 
necessary, that is, when the Officer has a reasonable belief to believe that the subject of such 
force poses an imminent danger of death or serious physical injury to the Officer or to 
another person. 


A. Deadly force may not be used solely to prevent the escape of a fleeing suspect. 
B. Firearms may not be fired solely to disable moving vehicles. 


C. If feasible and to do so would not increase the danger to the officer or others, 
a verbal warning to submit to the authority of the officer shall be given prior 
to the use of deadly force. 


D. Warning shots are not permitted. 


E. Officers will be trained in alternative methods and tactics for handling resisting subjects 
which must be used when the use of deadly force is not authorized by this policy." 


FBI DEADLY FORCE POLICY 


This Document has been prepared by the Federal Bureau of Investigation 
FOR LAW ENFORCEMENT USE ONLY 


LETSS/PAU ARREST PLAN FORM (01/01) 


` 
` 


ADMINISTRATION AND EQUIPMENT 


WEAPONS AND AMMUNITION 
Issued handgun. Long guns (if issued) available but not carried. Standard duty ammunition. 


CLOTHING AND EQUIPMENT 


Soft clothes. Cuffs. Body armor (available). Identifying jacket/shirt (available). 


HANDLING OF INJURED 
All injured will be handled per Glendale Fire protocol with on-scene medical and emergency transport. 


CONTROL AND COMMUNICATIONS 


COMMAND POST 


Supervisor in == SA | Location: University of Phoenix Stadium 
Radio Саше | сй] | 


ON-SCENE COMMAND 


Agent in Charge: TR] sd Location: University of Phoenix TEE 
Phone #: a | Radio Channel ШЕН Call брі) — | 


RADIO COMMUNICATIONS 


— di =s = s = 


This Document has been prepared by the Federal Bureau of Investigation 
FOR LAW ENFORCEMENT USE ONLY 


LETSS/PAU ARREST PLAN FORM (01/01) А-7 


x A 


(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


наға Date: 03/30/2010 
То: CIRG Attn: SEM b6 
55А b7C 
IA 
All Field Offices Attn: Special Events Coordinators 
Phoenix FIG 
From: Phoenix 
Squad NS- 
Contact: 


Approved By: 


Drafted 


Case ID 


Title: 


Synopsis: 


Details: 
Stadium, 


By: 


Le mk 
#: 300A-PX-84803 Z (Closed) 


300A-HQ-C1434728-PX (Pending) 
WORLD WRESTLING ENTERTAINMENT - WRESTLEMANIA XXVI; 
UNIVERSITY OF PHOENIX STADIUM - GLENDALE, ARIZONA 
MARCH 25-29, 2010 


Closing captioned matter. 


On 03/25/2010 through 03/29/2010, the University of Phoenix 
Glendale, Arizona hosted World Wrestling Entertainments's 


(WWE) Westlemania XXVI. 


Wrestlemania's attendance was approximately 75,000. This 
event was also attended by a multitude of VIPs, celebrities and 
professional athletes. The event also sold over a million pay per view 
telecasts worldwide and was covered by a host of local, national, and 
international media. 

This 


event took place with no adverse threats or actions. 
Case Agent P cru uis designated the primary liaison 
between PX FBI JTTF, the Glendale Police Department, event security, 


WWE officials and other public safety agencies. 


It is requested that the captioned matter be closed. 


4 
v 
ا‎ 


55900! TTI EC 


Ф UNCLASSIFIED @ 


To: CIRG From: Phoenix 
Re: 300A-PX-NEW, 02/11/2010 


Event Schedule: 


March 26 
- Phoenix Convention Center, WWE Media Day 
- Wirlwind Golf Club, WWE Pro-Am Golf Tournament 
- Heard Museum, Media Reception Dinner 
- Phoenix Sheraton, Make a Wish Autograph Signing 


March 27 
- Arizona Biltmore, Point Hilton, "Morning Madness" 
- Phoenix Public Library, "Wrestlemania Reading Challenge" 
- Phoenix Convention Center, WWE's "Axxess" 
- Phoenix Convention Center, Make A Wish Pizza Party 
- Phoenix Convention Center, Business Partners Summit 
- Dodge Theater, "WWE Hall of Fame Induction Ceremony" 


March 28 
- University of Phoenix Stadium, WWE "Fan Fest" 
- Renaissance Hotel, WWE VIP/Media Party 
- U of Р Stadium, Wrestlemania XXVI 


March 29 
- US Airways Center, Monday Night Raw 


The Phoenix Police Department (PPD) and Glendale Police 
Department (GPD) will be the primary law enforcement agencies 
handling the listed events. Neither PPD or GPD is requesting any 
augmentation of federal resources outside of what the Phoenix FBI 
office can provide. 


Considering the exposure and large number of attendees, 
this event could be a target for domestic and/or international 
terrorism. At this time, Phoenix has no positive information 
regarding any possible threats. 


Ring л j P a ee 
m designation of this event. At this point in time, Phoenix 
© 


eS mot request any augmentation from FBIHQ. FBI Phoenix plans 
on staffing the event Command Post and designating several 
Investigative Intelligence Teams for the events. 


It is requested that all receiving offices query local 
sources and intelligence databases for positive threat 


information regarding this event. An ositive information 
should be directed to TFO Assistant Phoenix 
Special Events Coordinator, or SA 


pem 


UNCLASSIFIED 


2 


өзе 


бу‏ ل“ 
e‏ 


Complaint Form à & 
FD-71 (Rev. 4-13-92) 


NOTE: Hand printfa egibly; handwriting satisfattory for remainder. А] ; psc A са) 
Indices: Negative C] See below / 2 /) ^7 
$ибеоср$ name and aliases Character of case 


vA sub : Lynton 5 XK eni ng Plane Calls 


UJ = — V CHA Complainant L Protect Source į 
ey Nov HONA CA) 


omplaint received 
| + i Р 5 IS 
М C ^ ÛJ Personal YK Telephonic Date 1 7 A 25 Тіте 2. 
ae 
Address a Complainant's address and telephone number и | 
Ln [4 ааа Ez dation, Stand, С 
Complainants DOB | SSAN Sex 
С Sex pee eg ШЕ үн С Date ала Вправа вив | 
мн aE sss | _ MN RR b 


Scars, marks-and Ger data 


Subject's 
Description 


Facts of complaint i 
(1, advised Hat G-lo PT ГА pun) 
foley lene. Calls LR Td laest Fridag ak ferwoos) 
(él WES |42 LES $00 Number ( Aeavice Ce Je“ 


focated ww Oklahome City , ok), Noe bor Callen by 
eee male жа /-%оо- 94$ —- 2641 + 
pee be, з Әс, /5 ёлга 
72, 0еклал keting, Duaha, NE, Ж. 
y "TT 
UNSub dla sa але 6 S ooo, 2277, Ye 25,4 ay (25/28) 
d be Кота “blow up te bold in ағас у 
Lil leadguartes Lu. Sanford, 5. MM 
Z PIA 4 Sou ec о<2 ¿zz с z Z , 
Á ПОЛА NES fo, werk fo a le FBI | 
( (oc a fr (vL Du Kv ows ы AN лл, “Zote nota Personne 


Z 
оба fern vel ee соғ 25-24 Do not write in this space. 
4 


2 


2 Philadelphia Алға, 
bar X (2/€) 85S - 9143. | 


(Complaint received by) 


n: NU- pur | 


192B-OC-56344 


white male, date of birth 
and white female date of birth 5/26/48, 


2501 Island Avenue, Philadelphia, 
Pennsylvania, an the non-published pay phone, 
(215) 365-8143 confirmed that PARKER, JR. is mentally slow. 
They stated that although he is sometimes a disciplinary 
problem for his father, he is generally a good kid. 


Through extensive interview and observation, it was 
determined tha has neither the mental 
capability, motivation, or physical means to carry out his 
threats. Subsequent to his admission of muc | 
perfusely apologized for his misbehavior and stated that he 
would never do it again. 


„Ж 


^РАСЕ 2 9А-МН-32763 UNCLAS 
IN OMAHA, NE.. THE POINT OF CONTACT AT IDELMAN TELEMARKETING 
1 1| 
EN avs THAT THE CALLS WERE RECEIVED AT ANOTHER 
FACILITY LOCATED IN OKLAHOMA CITY, OK. THE CALLER DEMANDED 
$5,000,000.00 BY MONDAY (7-3-95) OR HE WOULD "BLOW UP THE 
BUILDING", (PRESUMABLY WWF HQ LOCATED IN STAMFORD, CT.) NO 
FURTHER INFORMATION AVAILABLE AT THIS TIME REGARDING CALLS. 
ITI PERSONNEL CONTACTED AT&T AND DETERMINED THAT THE CALLS 
EMANATED FROM (215) 365-8143 IN THE PHILADELPHIA AREA. 
[т THAT THE CALLS WERE NOT RECORDED BUT MAY 
HAVE BEEN LOGGED ON AN INTERNAL INCIDENT REPORT. [|  — ір 
NOT HAVE THE NAMES OF THE OPERATORS THAT TOOK THE CALLS BUT 
STATED THAT HE WOULD OBTAIN THEM. 
CONTACTED THE STAMFORD POLICE DEPARTMENT WHO IN TURN 
CHECKED THE BUILDING AND FOUND IT TO BE SECURE. 
LEADS 


OMAHA DIVISION AT OMAHA, NEBRASKA 


WILL conract[ атт MARKETING, INC., 902 
NORTH 91ST PLAZA, OMAHA, NEBRASKA 68114 | | pw» 


OBTAIN THE NAMES OF THE OPERATORS THAT RECEIVED THE 


b6 
bic 


- 


“PAGE 3 9A-NH-32763 UNCLAS 
THREATENING/EXTORTIONATE CALLS. WILL FORWARD THIS INFORMATION 
TO OKLAHOMA CITY DIVISION. 

OKLAHOMA CITY DIVISION AT OKLAHOMA CITY, OKLAHOMA 

UPON RECEIPT OF THE ABOVE LISTED INFORMATION FROM THE 
OMAHA DIVISION, WILL INTERVIEW THE OPERATORS. WILL OBTAIN THE 
SPECIFIC THREAT, MODE OR DELIVERY OF THE MONEY REQUESTED, AND 
IDENTITY OF THE SPECIFIC TARGET. THE ITI FACILITY IN OKLAHOMA 
CITY IS LOCATED AT 4233 CHARTER AVENUE (405) 943-4966. WILL 
OBTAIN ANY AND ALL INCIDENT REPORTS. WILL FORWARD PERTINENT 
INFORMATION TO THE PHILADELPHIA DIVISION TO ASSIST IN THEIR 
LEAD. 

` PHILADELPHIA DIVISION AT PHILADELPHIA, PENNSYLVANIA 

WILL DETERMINE SUBSCRIBER TO (215) 365-8143. 

UPON RECEIPT OF INTERVIEW RESULTS CONDUCTED BY THE 
OKLAHOMA CITY DIVISION, WILL INTERVIEW SUBSCRIBER TO 
AFOREMENTIONED NUMBER. 


BT 


0018 MRI 01437 
PP FBINH FBIOC 
DE FBTOM #0002 1982255 
ZNR UUUUU 
P 1720022 JUL 95 
FM FBI OMAHA (9A-NH-32763) (RUC) 
TO FBI NEW HAVEN/PRIORITY/ 
FBI OKLAHOMA CITY/PRIORITY/ 
BT 
UNCLAS 
CITE: //3600// ада 
дд A 
SUBJECT: UNSUB; WORLD WRESTLING FOUNDATION (WWF) - VICTIM; 
EXTORTION(A); OO: NEW HAVEN. 
RE NEW HAVEN TELETYPE, DATED 7/13/95. | 
iw 
TELEMARKETING, INC. (ITI), OMAHA, NEBRASKA, WAS CONTACTED E 
REGARDING CAPTIONED MATTER. 
PER REFERENCED TELETYPE,| jas REQUESTED TO 
FURNISH THE IDENTITY OF THE TWO ITI OPERATORS RECEIVING THE 


THREATENING PHONE CALLS REGARDING THE WWF. THE OPERATORS ARE 


SEARCHED... XED... | 
SERIALIZED XC RA. SEX. 
JUL17195 | 


FBI — NEW HAVEN 


ЧА NU-S or. = 


` PAGE TWO DE FBIOM 0002 UNCLAS 


IDENTIFIED AS FOLLOWS: 


FOR INFORMATION OF OKLAHOMA CITY, OKLAHOMA CITY POLICE 


DEPARTMENT CASE NUMBER FOR CAPTIONED MATTER IS 95-062271. 

AS NO FURTHER INVESTIGATION REMAINS IN THE OMAHA 
DIVISION, THIS MATTER IS BEING PLACED IN RUC’D STATUS. 
BT 


#0002 


NNNN 


4 
| 


0010 MRI 00966 


RR FBIOC FBINH 


DE FBIPH 70002 2001812 

ZNR UUUUU 

R 1913572 JUL 95 

FM FBI PHILADELPHIA (192В-0С-56344) (5010) (RUC) 
TO FBI OKLAHOMA CITY/ROUTINE/ 

FBI NEW HAVEN (9A-NH-32763) /ROUTINE/ 

BT 

UNCLAS 


CITE: //3620:8Q10// 


SUBJECT: UNSUB; ITI MARKETING-VICTIM; HA-CI; 00: OC. 
RE OC TEL TO PH DATED 7/10/95 AND NH TEL TO DIRECTOR 

DATED 7/13/95 CAPTIONED UNSUB; WORLD WRESTLING FEDERATION 

(ar) -VrevIM; EXTORTION (A); OO: NH. Е 
BELL ATLANTIC-PENNSYLVANIA REVEALED THAT 215-365-8143 IS 

A NON-PUBLISHED PUBLIC TELEPHONE, AND WOULD REQUIRE A SUBPOENA 

FOR SUBSCRIBER INFORMATION. ADDITIONALLY, A PRETEXT CALL WAS 

MADE TO 215-365-8143. THE TELEPHONE RANG THREE TIMES, 


THEREAFTER A LOUD HIGH-PITCHED RINGING NOISE SIMILAR TO A FAX 


SEARCHED......... INDEXED....... 
SERIALIZED. 79 Ё. FILED... ДЗ, 


JUL 1 9 1995 


ЕВ! — NEW HAVEN 


=< > 

PAGE TWO DE FBIPH 0002 UNCLAS e 
MACHINE OCCURRED CONTINUOUSLY. 

IF THE OFFICE OF ORIGIN DEEMS NECESSARY, A FGJ SUBPOENA 
CAN BE DIRECTLY FAXED TO: BELL ATLANTIC-PENNSYLVANIA, INC., 
SECURITY DEPARTMENT, ROOM WEST 133, 99 SHAWAN ROAD, 
COCKEYSVILLE, MARYLAND 21030, FACSIMILE NUMBER 410-393-6062. 
BELL ATLANTIC-PENNSYLVANIA WILL RETURN THE EXECUTED SUBPOENA 
TO THE OO VIA FAX. 


BT 


k 


(03/31/95) 


Precedence: ROUTINE 


To: New Haven Attn: SA 
(BPT RA) 


From: Butte Information Technology Center 
Contact: | Phone: 

Approved By: 

Drafted By: 


File Number(s): 9A-NH-52753 E Зз 


Title: 
RECORD 


Synopsis: Attached are copies of printouts setting forth results 
of inquiries conducted by the IISC. Also attached is a copy of an 
accomplishment/reply form. It is requested that you record the 
IISC accomplishments on this form and return it to the IISC. 
Please maintain an additional copy with the computer printouts as 
a serial in your case file. 


Details: The following re ched for your review: ап 
address/update located SSAN issued 1976 in the State of 
CT associated to your Subject, address information, NCIC Drivers 
license info, and a property record. 


cc: 1-9 ial t Supervisor | 
із БА (FEDEX 7/14/95) 


i - 
i AME : Z por, 
! ыз س‎ [Nr 


JUL-13-1995 13:38 BRIDGEPORT RA L ва 
X ^o (ass orm omy I @ es Фф 


INVESTIGATIVE INFORMATION REQUEST FORM 


MA A / 
ITC Use Only: ,, /BITC Record f. f / 1 CG 
Date/Time la: 7/8! 22296) OmOm 


FBI, Butte Information Technology Center 
- 400 North Main Street, Room #115 . 
Butte, Montans 59701 
> Commercial Telephone: (406) 782-23 
> FTS: 700-585-2391 > FAX: (406) 2929504, 782-9507 & 782-7418 
> Secure FAX & STU TII: (406) 782-2304, Ext. 26 


TO: FBI, 1 BUTTE I INFORMATION TECHNOLOGY CENTER 
Date: 


Nonae Seas Related: 2. Type Teca O Mail — Reply: О FAX O Ta 
Requestor: Phone # X f: [ вк = 

иско М H e n [ui 
Office/RA: ЛАУ, Precedence: О ROUTINE D PRIORITY D IMMEDIATE 77 
Eee BEBE garop cm 

es о 

Driver's Lic. ІНЕ Û Yes Û No See Yes Û No Vebicle:L] Yes CJ No Drives’ s License: Yes СІ No 
Driver's License # tates Vehicle Registration: Stato _ 


SEARCH aco Ж 1 
Name - Las slo | мшш _ _ 


Alias: Sex: e ur — EU DRY eee 

SSANI: SSAN2: Spouse: 

RESIDENCE 

DEM. Ll ана 

BUSINESS 

Business Name: Street Address: 

City/State: р: Phone: Bus ID£: bE 

CHECK DESIRED. SEARCH P PL EG bc 
x e [OE rc», 


Associated with Social suny Number(s) 


0 2. a 
Û 3, Report Validity of Social Security Number 
ÛU, 4. Employment Report (subject to availability) INQUIRX WILL POST ТО CONSUMER'S ACCOUNT 
Ж5. Determine Who is Associated with Telephone Number(s) 
LJ 6. Determine Address of Business/Person ( U.S. ys State(s)) 
7. Determine Property Owned by Individual ( U.S. C7 , Sate) .. | i 
8. Determine Who Owns Property Listed Above 
9. Determine Who Resides at Address Listed Above 


19. Determine Financial Background Info, Financial Associates/Institutions (NOT FULL CREDIT REPORTING) 
Û 11. Determine Corporate Business Info/Institutions Associated with: 


(Persori/ Business) 


ШУР ossible Identifiable Records 
LJ Other Peripheral information 

Û Brief Synopsis of Information Found 
D) No Information Found 


“TOTAL Б.01 
уа е ІЛ ent =G s s 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkk TRW ADDRESS UPDATE ****wkhkkkhkhkhkkhkhkhakkhkikkikikkkk 
Dp 


D FBI, BUTTE ITC-INVESTIGATIVE INFORMATION SERVICES * 
* * 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkěk 


DATE: 07-14-1995 TIME: 07:55:16 SUBJECT ID:/ADDRESS UPDATE 


йыр 59 
G-G,V-0470427/3.34,H-Y; 


PAGE 1 DATE 7-14-95 TIME 6:55:00 РСІ01 V906 BCT1 


wen : YOB ra psx INIT IS J 


b6 
b7C 


----—- FILE IDENT: ss# IS MID INIT IS B 


------ FILE IDENT: 55% ID INIT IS J 


ADDRESS LOCATED REPORT TYPE G 
NOT TO BE USED FOR CREDIT GRANTING. 
MAY CONTAIN INFORMATION FOR MORE THAN ONE CONSUMER 


END -- ТЕЙ 


| *** END OF REPORT ID: 07-14-1995/07:55:16 (ORN: 110) *** 


ЖЖ к ККК k k k k k k k ke eee de kok k k R kok БЫ EQUIFAX DTEC kkkkkkkkkkkkkkkkkkkkkkkkkěkkkkkkkk 
> FBI, BUTTE ITC-INVESTIGATIVE INFORMATION SERVICES * 
* * 
de dede e e deck k k k ا‎ ee k k k dece dece e eee ok kok OK K KUR ЭСЕ R R dede eed R OR RUR K RUK eee eee R R R R dee eee 


TIME: 08:01:05 SUBJECT ID:| DTEC 


f b6 
Z 2 b7C 
SSN ISSUED +76 ) STATE ISSUED<CT 


& 


SS 


END OF REPORT EQUIFAX AND AFFILIATES - 07/14/95 


*** END OF REPORT ID: 07-14-1995/08:01:05 (ORN: 111) *** 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkk TRANS UNION TRACE ххх 


£ FBI, BUTTE ITC-INVESTIGATIVE INFORMATION SERVICES 
* 


* 
* 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk 


DATE: 07-14-1995 TIME: 08:01:43 SUBJECT ID: TRACE 

mep — —] 

TRANS UNION TRACE REPORT 

FOR MKT/SUB  INFILE DATE TIME 

QHO2870077 15 SC 07/14/95 9:01CT 

RPT ON DOB 

* SOCIAL SECURITY NUMBER TRACE * 
NAME/SPOUSE SSN OWNER 
ADDRESS ADDR RPT DATE 


1. SUBJECT 
06484 02/93 


**END OF NETWORK TRACE** 
COPYRIGHT 1993, TRANS UNION CORPORATION 


GO 
*** END OF REPORT ID: 07-14-1995/08:01:43 (ORN: 112) *** 


ЗСА ТРМ SOCIAL SEARCH — PR E ЖОК 
é FBI, BUTTE ITC-INVESTIGATIVE INFORMATION SERVICES * 
* * 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkěkkškkkk 
DATE: 07-14-1995 TIME: 08:04:19 SUBJECT ID: SOCIAL SEARCH 
9-040683775,У-04/042/3.34 


РАСЕ 1 DATE 7-14-95 TIME 7:04:03 РСВОЗ УА06 


END ~- TRW SOCIAL SEARCH 


*** END OF REPORT ID: 07-14-1995/08:04:19 (ORN: 113) *** 


т 


“ТІМЕ: 08:48:36 METRONET ONLLINE INFORMATION SYSTEM DATE: 07/14/95 

----------------------------- ADDRES == ------------- VER : 4.2 

OPTION : A (E)DA (N)BRS (A)DDR (P)HN (2)IP (C)ITY (S)TATE (U)S (K)CKPT 
(M) ENU (H)ELP (F)WD (B)ACK (W)METRO AREA (X) CLEAR 

SELECTION : FILE : В  (R)ESIDENTIAL (B)USINESS 

NAME : T NAME (Y/N): N STREET NAME (Y/N): 

HOUSE# | Husos ا‎ 

CITY ST : CT ZIP CODE: PHONE #: ( ) - 


RETURNED NAME/ADDRESS 


6484 
GENDER : FEMALE LENGTH OF RES : 09 NAME; E | 
MEDIAN INCOME : 0081.5K HOME OWNER PROB : 100 NAME: E | 
WEALTH RATING : B HOME VALUE : 0207.0K 
DATE OF BIRTH : HOME VALUE INDEX: 116 
DWELLING TYPE : SINGLE 
50 IN SESSION READY COMM OK ы | АО DCD RAP 


TIME: 08:48:54 METRONET]ON-LINE INFORMATION SYSTEM DATE: 07/14/9526 
-———— اا ااا ااا‎ NEIGHBORS,--------------- VER: 4.2 mS 


OPTION : N (E)DA (N)BRS (A)DDR (БУНЫ (Z)IP (C)ITY (S)TATE (U)S (K)CKPT 


. (M) ЕМО (H)ELP (F)WD (B)ACK (W)METRO AREA (X) CLEAR 
SELECTION : FILE : В  (R)ESIDENTIAL (B)USINESS 
**» ENTER R IN THE OPTION FIELD TO RETURN TO THE PREVIOUS ADDRESS SCREEN  «** 
NAME FIRST NAME (Y/N): N STREET NAME (Y/N): N 


HOUSE# STREET: 
CITY ST : CT ZIP CODE: PHONE £: ( ) - 


06484 SINGLE 09 
DU ТҮРЕ ТОК 


06484 SINGLE 22 


2 

06484 SINGLE 03 
3 

06484 SINGLE 07 
4 

06484 SINGLE 28 
5 


06484 SINGLE 23 
NEIGHBORS 01 TO 05 OF 07 ARE DISPLAYED. PRESS ENTER FOR THE NEXT PAGE. 
SO IN SESSION READY COMM OK "ЭД AO DCD RAP 


DATE: 07/14/95 | 
ER : 4.2 | 


GW.DCFBIWAX3.NmM[ ^  — — —  —pexzm.po[ ^ 1] b6 


b7C 
DCFBIWAXS 


NO NCIC WANT юв _ ja f Jex 


UIL 
txL 


MLOiTBz8528. DO. DCFRIWAXS. CT. TXT ww i poet |s=x/M 


МІ .41Т7В385258 
DCFBIWAXS 
MESSAGE AT 0959 ON 7/14/95 ACCEPTED 


DR. Сто Nadu 
(6:57 07/14/95 41042 
46:57 07/14/95 00197 DCFB1IWAX3 Е 


CT #6484 


OLN/ HGT/5ü02. EXP 12/98 
ENDORS RESTR 


@ 
n di N 


Universal Directorv of ALL Data for Connecticut 

For: | J 
1 О PeopleTracker Connecticut Gye 02 Mutiu} 
2 


Corporate ' CT - No Record оп PH Onlin 94 
3 Corp by Registered Agent Name connecticut Jla- t- Т аА À 
4 Local Index CT - No Record on PH Online YHRU N/A 

5 Bankruptcy CT - No Record on PH Online 
6 Social Security Deceased CT - No Record on PH Online 
7 Grant Deed CT - No Record on PH Online 

8 FAA Airmen Certification US - No Record on PH Online THRU 03/31/95 

9 Federal Aviation Admin. US - No Record on PH Online THRU 04/30/95 

10 Watercraft . US - No Record on PH Online THRU 12/31/93 
11 Government PER - No Record on PH Online 
12 Government BUS - No Record on PH Online 
13 Govermment SBA - No Record on PH Online 


End of list 
Enter request: < Do you want the help menu? М for NO, Y or enter for help: 


< 
Alt-Z FOR HELP| ANSI | FDX | 9600 E71 | LOG CLOSED | PRINT OFF | ON-LINE 


Your search request has found mo RECORDS. 


To edit the above request, use the arrow keys. Be sure to move the cursor 
to the end of the request before you enter it. 


To enter a new search request, type it and press the ENTER key. 
What you enter will be Search Level 1. 


For further explanation, press the H key (for HELP) and then the ENTER key. 
Press Alt-H for Help or .SO to End Session or  Alt-Q to Quit Software. 


e 29 vu 


LEVEL 1 - 1 OF 1 RECORD 


ххх THIS DATA IS FOR INFORMATION PURPOSES ONLY *** 
Copyright 1994 Commercial Record Publishing Company 
PROPERTY RECORD FOR FAIRFIELD COUNTY, CT 

ESTIMATED ROLL CERTIFICATION DATE OCTOBER 31, 1993 

omer: s 

Mailing Address: 6484 

Property Address: 06484-4834 

Township: SHELTON 


kkkkkkkkkkkkkkkkkkkkkkkkkkkkk SALES INFORMATION deeddekddekdkkdckdekdekdekkk eee e 


kkkkkkkkkkkkkkkkkkkkkkkkkk ASSESSMENT INFORMATION J*kddekddekdckdek deck eee 


Press Alt-H for Help or .50 to End Session or» Alt-Q to Quit Software. 


Po €f 06484-4834 


Assessor's Parcel Number: M:0031 B:0065 L:0000 
Legal Description: CENSUS TRACT: 1102.00 А 
Land Use: RES DWELL 
Assessment Year: 1993 
Land Value: $ 42,420 
Improvement Value: $ 99,400 
Total Value: $ 141,820 
kkkkkkkkkkkkkkkkkkkkkkkkkkkkk ТАХ INFORMATION ЖХХХХХХХХХХЗХХХЖЕХХЖХХХХХХХЖЯЯ 
Tax Year: 1993 


le He He He e He e e He e e e e e ¥ e e ¥ e ¥ ¥ kK ¥ ¥ PROPERTY CHARACTERISTICS Hitt kk Hoe Re EE RK 


Year Built: No. of Buildings: 
Press Alt-H for Help or .SO to End Session or  Alt-Q to Quit Software. 


FAIRFIELD county, cr C — 1 |Ст 06484-4834 


Stories: Style: 
Units: Air Conditioning: | 


Bedrooms: 
Baths: 

Partial Baths: 
Total Rooms: 
Fireplace: 
Garage Туре: 
Garage Size: 
Pool/Spa: 


Heating: 

Construction: 

Basement: 

Exterior Walls: 
Foundation: 

Roof: 

Elevator: 

Lot Size: 1.61AC 
Building Area: 


Press Alt-H for Help or .50 to End Session or Alt-Q to Quit Software. 


а **APLEASE RETURN****+=* 
е INVESTIGATIVE INFORMATION SERVICES 
REPLY FORM 


In order to help us better serve your investigative needs, 
please complete the following and return to: 


FBI, Butte Information Technology Center 
400 North Main Street, Room £115 


Butte, Montana 59701 
JA-NH- 5 3:153 


UCEN: 


Was the infprmattion ргоуі helpful to your investigation? П YES П NO 


If NO, please let us know how we could be more helpful to your 
investigation: 


ACCOMPLISHMENT(S) resulting from information: 
PERSON(S): (Enter total number applicable to each of the following). 


FBI Fugitive(s) Arrested: O FBI О Local Date 

(Forward photo of Fugitive arrested with this Reply form) 
Local Fugitive(s) Arrested: П FBI Û Local Date 

(Forward photo of Fugitive arrested with this Reply form) 
Subject(s) O Arrested Û Located Û Identified 

(Forward photo of Subject arrested with this Reply form) 
Witness(es) П Located O Identified 
New Witness(es) П Located П Identified 
BUSINESS(ES): (Enter total number applicable to each of the following) 


New Business(es) Identified 


New Business Associates/Associations Identified 

Financial Audit Trail(s) Enhanced I 

ASSET(S): (Enter total number applicable to each of the OES) 
(TYPES: C = CASH R = REAL PROPERTY P = PERSONAL PROPERTY) 


Asset (=) Ü Located П Identified (VALUE: _  Á. TYPE: _ 
Asset(s) Subject to Seizure/Forfeiture (VALUE: TYPE: | _] 
Potential Economic Loss Prevented [VALUE: ТҮРЕ: ] 

OTHER: (Enter total number applicable to each of the 
New Case(s) Initiated j SA 


New Lead(s) Generated 


COMMENTS: T ———————————————— 


1 - Case File - 
1 - BITC #+*+++++ -PLEASE RETURN ex Ax 


C 


U.S. Department of Justice 


Federal Bureau of Investigation 


35 Courtland Street 
ш Reply, Please Refer to Bridgeport, CT 06604 
File №. 9A-NH-32763 August 1, 1995 


United States Attorney'/s Office 
915 Lafayette Blvd. 
Bridgeport, CT 06604 


Attention: LL. B United States Attorney 
was 


Serivla orood a| we 
RE: Extortion/bomb threat at 


a RIHO si о! А 
Per peu e 2094 the World Wrestling 
Той ener L. 2,» Federation (WWF) 


m мено af Zo "ui 
вас аро с 
Files and Records, 


This is to confirm a conversation on July 31, 1995 
between Assistant United States attorney[ есінде 
Special Agent wherein the matter of an extortion/ 


bomb threat at e Wor Wrestling Federation was discussed. On 
June 30, 1995, 9-10 calls were received on WWF’s 800 number. 
This number is broadcast on WWF’s televised programs. 


The calls which were tracked by AT&T to (215) 365-8143, 
came into the 800 number being manned by operators in Oklahoma 
City, Oklahoma. The caller demanded $5,000,000.00 by Monday 
(July 3, 1995) or he would "blow up the building", presumably the 
WWF building located in Stamford, Connecticut. The building was 
checked by the Stamford Police Department and found to be secure. 


A check by the Philadelphia Office of the Federal 
Bureau of Investigation determined that the number (215) 365-8143 
is a non-published public phone. Subscriber information would 
require a subpoena. 


Presently, the Oklahoma City Office of the Federal 
Bureau of Investigation is taking steps to obtain a subpoena for 
this number. Special mente the Oklahoma City Office 
advised that once he obtains the subscriber information to the 
number, he will present the case to e United States Attorney’s 
Office in Oklahoma. 2 


Ор -M - z6302.- be 


During the conversation between AUSA Сапа SA 
[prosecution of this case was declined. 


0001 MRI 01806 
RR FBIOC FBINH 
DE FBIPH #0004 2280000 


ZNR UUUUU 


R 1522417 AUG 95 
FM FBI PHILADELPHIA (192В-ОС-56344) (SQ10) (P) 
TO FBI OKLAHOMA CITY/ROUTINE/ 
FBI NEW HAVEN (9A-NH-32763) /ROUTINE/ 
BT 
UNCLAS 
CITE: //3620:5010// 
SUBJECT: UNSUB; III а аттты HA-CI; OO: OC. 
RE OC TEL TO PH DATED 7/10/95, NH TEL TO BU DATED 
7/13/95, CAPTIONED, "UNSUB; WORLD WRESTLING FEDERATION (WWF)- 
VICTIM; EXTORTION (A); OO: NH, AND OC TEL TO PH DATED 8/2/95. 


BEING SENT UNDER SEPARATE COVER TO OC AND NH ARE THE 


MALE, poB[| ^ ADMITTED MAKING BOMB THREATS AND 


MONETARY DEMANDS FROM THE FAMOUS PHILY’S PAY PHONE NUMBER 215- 


365-8143 TO THE WWF'S 800 NUMBER, 1-800-848-2691, MONITORED BY 


| Ф 
--PEÉR TWO DE FBIPH 0004 UNCLAS 
THE CAPTIONED VICTIM ON 6/30/95. 
| IS А MENTALLY SLOW AND IMMATURE JUVENILE WHO DOES 
NOT POSSESS THE MENTAL CAPACITY, MOTIVATION OR PHYSICAL MEANS 
TO CARRY OUT HIS THREATS. 
[ | FATHER WAS MADE AWARE OF THE SITUATION, AND 
ASSURED THE FBI IT WILL NOT OCCUR AGAIN. 


BT 


#0004 


NNNN 


y ТР 


FEDERAL BUREAU OF INVESTIGATION 


ч FD-302 (Rev. 3-10-82) 


8/18/95 


Date of transcription 


white m irth 
Social Security Account Number home 
Philadelphia, Pennsylvania 


ress 


(PA) 19142, home telephone was apprised of the 
identity of i rviewing agents and the nature of the 
in i interviewed in the presence of his father, 


was talked to concerning his knowledge of the 
extortionate phone calls made to telephone number 1-800-848-2691. 
This telephone number is broadcast by the WORLD WRESTLING 
FEDERATION during their televised shows. [|  þavisea as 
follows: 


: After numerous attempts to deny involvement, 
finally admitted making the extortionate phone calls from the 
non-pubiished pay phone at FAMOUS PHILY’S, 2501 Island Avenue, 
Philadelphia, PA, phone number (215) 365-8143. [ ^ ]admittea 
to making all five of the phone calls to the 1-800 number 
advertised by the WORLD WRESTLING FEDERATION during its 
broadcasting. During these phone calls he demanded anywhere from 
$2,000,000 to $5,000,000 or he would blow up one of their 
buildings. At the time of the phone calls,[ ^ believed he 
was talking to a representative of the WORLD WRESTLING 
FEDERATION. 


mmm EE: ug; - present for the 
duration О e interview and subsequent admission of guilt by 


his son. When dues опе why he made the threatening phone calls 
à Ш 


The following information on[| (ав obtained , 


through observation and interrogation: РИ: 
SEAR 
{ SERIALL A (АТА Ten 
Race: White 
Eun 2 305 ib КЕК 


геа reed pan AED 


Investigation on 8/14/95 а Philadelphia, PA File # d Z56344 (5010) 
SAs nd g- M d- 3270 3- Š 
by FY/ja Date dictated 8/14/95 


This document contains neither recommendations nor conclusions of ће FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


БОЧНЕ ОНИЕ > 


, FD-302a (Rev. 11-15-83) 
\ 


192B-OC-56344 (SQ10) 


Continuation d D202 of ры. И On Ë Í ы / 2 3 2 Page = 


Sex: Male 

Height: 5 feet, 10 inches 

Weight: Between 160 and 170 pounds 
Build: Medium 

Hair: Brown 

Eyes: Blue 


Place of birth: 


Education: 


Parent: 


Miscellaneous: It should be noted that 
although not retarded, is mentally 
slow and considered to have a 
learning disability 


° @ 


FD-36 (Rev. 11-17-88) 


А ЕВІ 
j 
TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 
L] Teletype ГІ Immediate L] TOP SECRET 
[] Facsimile L] Priority . [L] SECRET 
K] AIRTEL ГІ Routine [] CONFIDENTIAL 
[| UNCLAS E F T O 
O UNCLAS 


Date 8/22/95 


TO : SAC, OKLAHOMA CITY (192B-OC-56344) 


FROM : SAC, PHILADELPHIA (192В-ОС-56344) (5010) (RUC) 


SUBJECT : -UNSUB;0% 
ITI MARKETING - VICTIM; 
HA-CI; 


оо: ос a 


Reference Philadelphia teletype to Oklahoma City and 
v= Haven dated 8/15/ 


| = Enclosed for Oklahoma City are the original and one 
of the FD-302 regarding the interview of pr 


white male, date of birt 


Enclosed for New Haven is one copy of the FD-302 sent 
to Oklahoma City. 


On 8/14/95, [| Ьөш«ееа to making the extortionate 
and threatening phone calls received by captioned victim at 
telephone number [ ^ | from the FAMOUS PHILY'S pay- 
phone, phone number (215) 365-8143. This specific inf 
of this interview and subsequent admission of guilt B 
is contained in the enclosed FD-302. 


white male, date of pirth[ | 
father o was p nd cooperative during the | 
jnterview Ts son. Senior stated that his son is 


mentally slow and immature, and has been diagnosed with а 
learning disability. 


- Oklahoma City (Enc. 2) ql 
N 


2} New Haven (Enc. 1) Ше? 
1- Philadelphia (192B-OC-56344) (5010) Борн 0 >С, 


Poses 


(5) 


FD: — REV HAVT М: 


Approved: 'Transmitted. Per | 
(Number) (Time) | 


ex 


FD-36 (Rev. 8-29-85) 


FBI 

TRANSMIT VIA: PRECEDENCE: CLASSIFICATION: 

X] Teletype ГІ Immediate ГІ TOP SECRET 

[] Facsimile Ë] Priority [] SECRET 

L] AIRTEL [IX] Routine [1 CONFIDENTIAL 
L] UNCLASEF TO 
[| UNCLAS 


Date 7/13/95 


FM FBI NEW HAVEN (9A-NH-32763) (P) 
TO DIRECTOR FBI/ROUTINE/ 

OKLAHOMA CITY/ROUTINE/ 

FBI OMAHA/ROUTINE/ 

FBI PHILADELPHIA/ROUTINE/ 

BT 

UNCLAS 


CITE: //3520// 


SUBJECT: UNSUB; WORLD WRESTLING FOUNDATION (WWF) -VICTIM; 
EXTORTION (A); OO: NH. 
FOR THE INFORMATION OF THE BUREAU AND RECEIVING OFFICES, ON 7- 
e-s| | | |] WWF, STAMFORD, connzcricur] | | 
EE THAT ON 6-3095, 9-10 THREATENING/EXTORTIONATE 
TELEPHONE CALLS WERE RECEIVED ON THEIR 800 NUMBER.  WWF'/S 800 
NUMBER, 1-800-848-2691 IS BROADCAST ON THEIR TELEVISED SHOWS. 


THIS NUMBER IS SERVICED BY IDELMAN TELEMARKETING, INC. (ITI) 


(uu ҮЙ БШ TRENAR 
@ p- — 


INDEXED | 
Approved: Original filename; 


Time Received: Telprep filename: 


MRI/JULIAN DATE: 


